CVE-2025-15027: JAY Login & Register WordPress Plugin Privilege Escalation (CWE-269)
CVE-2025-15027 affects the JAY Login & Register plugin for WordPress in all versions up to and including 2.6.03. According to the record, a flaw in the function jay_login_register_ajax_create_final_user lets a user update arbitrary user metadata, which can allow an unauthenticated attacker to gain administrator privileges. The CNA rated it critical with a CVSS 3.1 score of 9.8, and no confirmed exploitation appears in the sources consulted.
Overview
The JAY Login & Register plugin for WordPress contains a privilege escalation flaw classified as CWE-269 (Improper Privilege Management). According to the record, the plugin lets a user update arbitrary user metadata through the function 'jay_login_register_ajax_create_final_user'.
Impact
- The record states that unauthenticated attackers can elevate their privileges to administrator.
- The CVSS 3.1 vector reported by the CNA rates confidentiality, integrity and availability impact as High, with no privileges or user interaction required.
- Escalation to administrator would give an attacker broad control over the WordPress site, including its content, users and settings.
Affected products and versions
- Product: JAY Login & Register plugin for WordPress.
- Affected range stated in the description: all versions up to and including 2.6.03.
- The structured affected and fixed fields in the record are empty, so no fixed version is confirmed in the sources consulted.
Exploitation status
The record does not list this CVE in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Check whether the JAY Login & Register plugin is installed and which version is in use.
- Because no fixed version is identified in the sources, check the vendor or the plugin's official distribution channel for an update. Inference: later releases than 2.6.03 are presumably outside the stated vulnerable range, but this must be verified.
- If the plugin is not needed, deactivate and remove it.
- Review administrator accounts and recent role changes for unexpected entries, and reset credentials if compromise is suspected.
Detection guidance
- Review the list of WordPress administrator accounts for accounts that were not created by your team.
- Audit changes to user metadata and role assignments where logging is available.
- Review web server and application logs for unusual requests related to the plugin's registration workflow.
Limitations of the available information
- The record gives only an upper bound for affected versions and no fixed version.
- The only CVSS score in the record is provided by the CNA (security@wordfence.com).
- The EPSS values are as recorded, and the EPSS date is later than the publication date, so values may change.
- The record does not describe technical details beyond the function name, so this analysis does not explain exploitation mechanics.
Frequently asked questions
Which versions of the JAY Login & Register plugin are affected?
The record states that all versions up to and including 2.6.03 are vulnerable. No fixed version is listed in the sources consulted.
Is this vulnerability being actively exploited?
The record does not list CVE-2025-15027 in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
What should administrators do now?
Check whether the plugin is installed, obtain an update from the vendor if one is available, remove the plugin if it is not needed, and review administrator accounts for unexpected changes.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.