PT-2026-6941

CVE-2025-15027

·

Published

2026-02-07

·

Updated

2026-02-13

Description by

CVSS 3.1
9.8
Critical
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions JAY Login & Register plugin for WordPress versions prior to 2.6.04
Description The JAY Login & Register plugin for WordPress is susceptible to a privilege escalation issue. The plugin allows updating arbitrary user meta through the jay login register ajax create final user function, potentially enabling unauthenticated attackers to gain administrator privileges.
Recommendations Update the JAY Login & Register plugin to version 2.6.04 or later.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-269: Improper Privilege Management
Related identifiers
CVE-2025-15027
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com