CVE-2025-4607

Name of the Vulnerable Software and Affected Versions PSW Front-end Login & Registration plugin for WordPress versions up to, and including, 1.12

Description The issue is related to Privilege Escalation due to a weak, low-entropy OTP mechanism used in the forget() function. This allows unauthenticated attackers to initiate a password reset for any user, including administrators, potentially leading to full site takeover. The customer registration() function is also implicated in this issue.

Recommendations For versions up to, and including, 1.12, consider disabling the customer registration() function and restricting the use of the forget() function until a patch is available. Additionally, avoid using the weak OTP mechanism in the forget() function to minimize the risk of exploitation.