The Frontend Login and Registration Blocks WordPress plugin by arkenon suffers from an unverified password change vulnerability (CWE-620) identified as CVE-2025-3607. Authenticated users with low privileges can exploit this flaw to change passwords of other users, including administrators, because the plugin does not properly validate user identity before allowing password updates. This results in privilege escalation and potential full account takeover. The vulnerability affects all versions up to and including 1.0.8. No patch or official remediation has been disclosed at this time.

Successful exploitation allows an authenticated user with Subscriber-level privileges or higher to change any user's password, including administrators. This leads to privilege escalation, enabling attackers to gain unauthorized administrative access, compromising confidentiality, integrity, and availability of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for suspicious password changes. Avoid granting Subscriber-level or higher privileges to untrusted users. Follow updates from the vendor for an official patch or temporary mitigation.