CVE-2025-14440

The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.01. This is due to incorrect authentication checking in the 'jay_login_register_process_switch_back' function with the 'jay_login_register_process_switch_back' cookie value. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/browser/jay-login-register/tags/2.4.01/includes/jay-login-register-user-switching.php#L98
https://plugins.trac.wordpress.org/changeset/3418754/
https://www.wordfence.com/threat-intel/vulnerabilities/id/928877a6-eeeb-4ed5-900b-9b1560e1bf87?source=cve

Configurations

No configuration.

History

07 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) El plugin JAY Login & Register para WordPress es vulnerable a omisión de autenticación en versiones hasta la 2.4.01, inclusive. Esto se debe a una comprobación de autenticación incorrecta en la función 'jay_login_register_process_switch_back' con el valor de la cookie 'jay_login_register_process_switch_back'. Esto hace posible que atacantes no autenticados inicien sesión como cualquier usuario existente en el sitio, como un administrador, si tienen acceso al ID de usuario.

Information

Published : 2025-12-13 16:16

Updated : 2026-10-07 20:10

NVD link : CVE-2025-14440

Mitre link : CVE-2025-14440

CVE.ORG link : CVE-2025-14440

JSON object : View

Products Affected

No product.

CWE

CWE-565

Reliance on Cookies without Validation and Integrity Checking

{"id": "CVE-2025-14440", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14440", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-15T15:30:23.207063Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "jayarsiech", "product": "JAY Login & Register", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.4.01"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-13T16:16:49.570", "references": [{"url": "https://plugins.trac.wordpress.org/browser/jay-login-register/tags/2.4.01/includes/jay-login-register-user-switching.php#L98", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset/3418754/", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/928877a6-eeeb-4ed5-900b-9b1560e1bf87?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-565"}]}], "descriptions": [{"lang": "en", "value": "The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.01. This is due to incorrect authentication checking in the 'jay_login_register_process_switch_back' function with the 'jay_login_register_process_switch_back' cookie value. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id."}, {"lang": "es", "value": "El plugin JAY Login & Register para WordPress es vulnerable a omisi\u00f3n de autenticaci\u00f3n en versiones hasta la 2.4.01, inclusive. Esto se debe a una comprobaci\u00f3n de autenticaci\u00f3n incorrecta en la funci\u00f3n 'jay_login_register_process_switch_back' con el valor de la cookie 'jay_login_register_process_switch_back'. Esto hace posible que atacantes no autenticados inicien sesi\u00f3n como cualquier usuario existente en el sitio, como un administrador, si tienen acceso al ID de usuario."}], "lastModified": "2026-10-07T20:10:01.970", "sourceIdentifier": "security@wordfence.com"}