CVE-2025-14440 affects the JAY Login & Register plugin for WordPress, where the 'jay_login_register_process_switch_back' function improperly authenticates users based solely on the value of a cookie. This lack of validation allows attackers to bypass authentication controls and assume the identity of any user on the site if they know the user ID. The vulnerability is due to reliance on cookies without validation or integrity checks (CWE-565). It impacts versions up to and including 2.4.01. The CVSS 3.1 base score is 9.8, reflecting critical impact on confidentiality, integrity, and availability.

An attacker can gain unauthorized access to any user account on the affected WordPress site, including administrative accounts, leading to full compromise of the site. This includes complete control over site content, user data, and administrative functions. The vulnerability does not require any privileges or user interaction and can be exploited remotely over the network.

No official patch or fix is currently available as per the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, it is recommended to disable or remove the JAY Login & Register plugin to prevent exploitation. Monitor vendor channels for updates and apply any official patches promptly once available.