Vulnerability · Published May 23, 2025 · Assigned by Patchstack

CVE-2025-47646WordPress PSW Front-end Login & Registration plugin <= 1.13 - Broken Authentication Vulnerability

Critical 9.8

In plain English

A critical-severity security flaw in PSW Front-end Login & Registration from Gilblas Ngunte Possi. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 24.7% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)24.7%top 2.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling2Nuclei, Public PoC

Official description

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Gilblas Ngunte Possi PSW Front-end Login & Registration psw-login-and-registration allows Password Recovery Exploitation.This issue affects PSW Front-end Login & Registration: from n/a through <= 1.13.

Affected products (as reported)

Vendor	Product	Versions
Gilblas Ngunte Possi	PSW Front-end Login & Registration	0 – through 1.13

Weakness: CWE-640 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://patchstack.com/database/Wordpress/Plugin/psw-login-and-registration/vulnerability/wordpress-psw-front-end-login-registration-1-12-broken-authentication-vulnerability?_s_id=cve vdb-entry