CVE-2025-4607 is a critical security vulnerability identified in the PSW Front-end Login & Registration plugin for WordPress, affecting all versions up to and including 1.12. The root cause is the use of an insufficiently random, low-entropy OTP mechanism within the forget() function, which is responsible for password reset operations. This weak randomness allows unauthenticated attackers to predict or forge OTP tokens, thereby initiating password resets for arbitrary users without any authentication or user interaction. The vulnerability is exploited via the customer_registration() function, enabling privilege escalation from an unauthenticated state to administrator-level access. This results in a full site takeover, compromising confidentiality, integrity, and availability of the affected WordPress site. The vulnerability is categorized under CWE-330, highlighting the use of insufficiently random values as the fundamental flaw. The CVSS v3.1 base score is 9.8 (critical), with attack vector network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). Although no public exploits are known at this time, the vulnerability’s characteristics make it highly exploitable. The lack of patch links indicates that a fix is either pending or not yet publicly available, increasing the urgency for mitigation. The vulnerability affects all versions of the plugin, which is used globally in WordPress environments, often integrated into websites requiring user registration and login functionality.

The impact of CVE-2025-4607 is severe for organizations worldwide using the PSW Front-end Login & Registration plugin. Successful exploitation allows attackers to bypass authentication mechanisms and reset passwords for any user, including administrators, leading to complete site takeover. This compromises the confidentiality of sensitive user data, the integrity of website content and configurations, and the availability of services hosted on the WordPress site. Attackers could deploy malware, deface websites, steal data, or use the compromised site as a pivot point for further attacks within an organization’s network. The vulnerability’s ease of exploitation without authentication or user interaction increases the risk of widespread automated attacks. Organizations relying on this plugin for customer-facing portals or internal applications face potential reputational damage, regulatory penalties, and operational disruptions. The absence of a patch at the time of disclosure further exacerbates the risk, requiring immediate compensating controls to prevent exploitation.

To mitigate CVE-2025-4607, organizations should immediately assess their exposure by identifying all WordPress instances running the PSW Front-end Login & Registration plugin. Until an official patch is released, the most effective mitigation is to disable or uninstall the vulnerable plugin to eliminate the attack vector. If disabling is not feasible, restrict access to the password reset functionality by implementing web application firewall (WAF) rules that detect and block suspicious requests targeting the forget() and customer_registration() functions. Additionally, enforce strong multi-factor authentication (MFA) for all administrator accounts to reduce the impact of potential account takeover. Monitor logs for unusual password reset requests or account activity indicative of exploitation attempts. Regularly update WordPress core and plugins to the latest versions once patches become available. Consider deploying rate limiting on password reset endpoints to reduce the risk of brute force or automated attacks. Finally, educate site administrators about the vulnerability and encourage prompt response to suspicious activity.