PT-2025-51072

CVE-2025-14440

·

Published

2025-12-12

·

Updated

2025-12-18

Description by

CVSS 3.1
9.8
Critical
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions JAY Login & Register plugin for WordPress versions prior to 2.4.01
Description The JAY Login & Register plugin for WordPress has a flaw in authentication. Incorrect authentication checking within the jay login register process switch back function, utilizing the jay login register process switch back cookie, allows attackers to bypass authentication. This enables unauthenticated attackers to log in as any existing user, including administrators, if they have access to the user id.
Recommendations Update the JAY Login & Register plugin to a version later than 2.4.01.
Exploitability
Fix
Researchers
Vendors
Affected products
Weakness enumeration
CWE-565: Reliance on Cookies without Validation and Integrity Checking
Related identifiers
CVE-2025-14440
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com