CVE-2025-15001

CRITICAL

FS Registration Password <1.0.1 - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-15001. PoCs published by r00thex.

AI-analyzed exploit summary This exploit targets CVE-2025-15001, an unauthenticated account takeover vulnerability in the 'root Registration Password' WordPress plugin (versions <= 1.0.1). The flaw allows attackers to inject a known password reset key via a crafted request to the password reset flow, then use that key to reset the target user's password.

Description

The FS Registration Password plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.

Exploits (1)

github WORKING POC 1 stars
by r00thex · pythonpoc
https://github.com/r00thex/CVE-2025-15001-Exploit

This exploit targets CVE-2025-15001, an unauthenticated account takeover vulnerability in the 'root Registration Password' WordPress plugin (versions <= 1.0.1). The flaw allows attackers to inject a known password reset key via a crafted request to the password reset flow, then use that key to reset the target user's password.

Classification
Working Poc 98%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: WordPress plugin 'root Registration Password' <= 1.0.1
No auth needed
Prerequisites: Target must be running WordPress with the vulnerable plugin installed · Attacker must know or enumerate a valid username · Target must not have WAF/rate-limiting blocking the exploit requests
mistral-large-3 · analyzed Aug 01, 2026 Full analysis →

References (3)

Core 3

Scores

CVSS v3 9.8
EPSS 0.0037
EPSS Percentile 29.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-639
Status published
Products (1)
fsylum/FS Registration Password < 1.0.1
Published Jan 06, 2026
Tracked Since Feb 18, 2026