CVE-2025-14440criticalCWE-565

CVE-2025-14440: fallo crítico en jayarsiech JAY Login & Register

JAY Login & Register <= 2.4.01 - Authentication Bypass via Cookie

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear JAY Login & Register

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.8epss 0.8%
The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.01. This is due to incorrect authentication checking in the 'jay_login_register_process_switch_back' function with the 'jay_login_register_process_switch_back' cookie value. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
jayarsiech · JAY Login & Register
CVEs relacionadas — jayarsiech JAY Login & Register

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-15027CRITICALJAY Login & Register <= 2.6.03 - Unauthenticated Privilege Escalation via jay_login_register_ajax_create_final_userEPSS 0.5%CVE-2025-15100HIGHJAY Login & Register <= 2.6.03 - Authenticated (Subscriber+) Privilege Escalation via jay_panel_ajax_update_profileEPSS 0.3%