CVE-2025-15027 is a critical privilege escalation vulnerability in the JAY Login & Register WordPress plugin (up to version 2.6.03). The issue arises because the plugin's 'jay_login_register_ajax_create_final_user' function improperly allows unauthenticated users to modify arbitrary user meta data. This improper privilege management (CWE-269) can be exploited to elevate privileges to administrator, potentially compromising the entire WordPress site. The vulnerability has a CVSS v3.1 score of 9.8, reflecting its high impact and ease of exploitation over the network without authentication or user interaction.

Successful exploitation allows unauthenticated attackers to gain administrator privileges on affected WordPress sites, leading to full site compromise including control over content, user accounts, and potentially the underlying server environment. The vulnerability impacts confidentiality, integrity, and availability (all rated high). No known exploits have been reported in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable or remove the JAY Login & Register plugin to prevent exploitation. Monitor official vendor channels for updates and apply patches promptly once available.