CVE-2025-14440

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14440", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-10T12:22:08.723Z", "datePublished": "2025-12-13T04:31:30.111Z", "dateUpdated": "2026-04-08T17:09:27.946Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:09:27.946Z"}, "affected": [{"vendor": "jayarsiech", "product": "JAY Login & Register", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.4.01", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.01. This is due to incorrect authentication checking in the 'jay_login_register_process_switch_back' function with the 'jay_login_register_process_switch_back' cookie value. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id."}], "title": "JAY Login & Register <= 2.4.01 - Authentication Bypass via Cookie", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/928877a6-eeeb-4ed5-900b-9b1560e1bf87?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/jay-login-register/tags/2.4.01/includes/jay-login-register-user-switching.php#L98"}, {"url": "https://plugins.trac.wordpress.org/changeset/3418754/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-565 Reliance on Cookies without Validation and Integrity Checking", "cweId": "CWE-565", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Kenneth Dunn"}], "timeline": [{"time": "2025-12-12T16:06:15.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-15T15:30:23.207063Z", "id": "CVE-2025-14440", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:33:41.872Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14440", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-15T15:30:23.207063Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:30:24.318Z"}}], "cna": {"title": "JAY Login & Register <= 2.4.01 - Authentication Bypass via Cookie", "credits": [{"lang": "en", "type": "finder", "value": "Kenneth Dunn"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "jayarsiech", "product": "JAY Login & Register", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.4.01"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-12T16:06:15.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/928877a6-eeeb-4ed5-900b-9b1560e1bf87?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/jay-login-register/tags/2.4.01/includes/jay-login-register-user-switching.php#L98"}, {"url": "https://plugins.trac.wordpress.org/changeset/3418754/"}], "descriptions": [{"lang": "en", "value": "The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.01. This is due to incorrect authentication checking in the 'jay_login_register_process_switch_back' function with the 'jay_login_register_process_switch_back' cookie value. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-565", "description": "CWE-565 Reliance on Cookies without Validation and Integrity Checking"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:09:27.946Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14440", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:09:27.946Z", "dateReserved": "2025-12-10T12:22:08.723Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-13T04:31:30.111Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "JAY Login & Register", "vendor": "jayarsiech", "versions": [{"lessThanOrEqual": "2.4.01", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.01. This is due to incorrect authentication checking in the 'jay_login_register_process_switch_back' function with the 'jay_login_register_process_switch_back' cookie value. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id."}, {"lang": "es", "value": "El plugin JAY Login & Register para WordPress es vulnerable a omisi\u00f3n de autenticaci\u00f3n en versiones hasta la 2.4.01, inclusive. Esto se debe a una comprobaci\u00f3n de autenticaci\u00f3n incorrecta en la funci\u00f3n 'jay_login_register_process_switch_back' con el valor de la cookie 'jay_login_register_process_switch_back'. Esto hace posible que atacantes no autenticados inicien sesi\u00f3n como cualquier usuario existente en el sitio, como un administrador, si tienen acceso al ID de usuario."}], "id": "CVE-2025-14440", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14440", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-12-15T15:30:23.207063Z", "version": "2.0.3"}}]}, "published": "2025-12-13T16:16:49.570", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/jay-login-register/tags/2.4.01/includes/jay-login-register-user-switching.php#L98"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3418754/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/928877a6-eeeb-4ed5-900b-9b1560e1bf87?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-565"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T17:10:15.623440+00:00", "value": {"mitigation_remediation": ["Upgrade the JAY Login & Register plugin to a version newer than 2.4.01 that removes the vulnerable cookie handling \u2013 the fix is included in the latest releases.", "If an update is not immediately possible, deactivate or delete the plugin to prevent exploitation while a patch is applied.", "As a temporary workaround, modify the plugin\u2019s code or server configuration to block the use of the 'jay_login_register_process_switch_back' cookie so that the authentication bypass cannot be triggered."], "summary": {"action": "Immediate Patch", "impact": "Authentication Bypass"}, "threat_synthesis": {"affected_systems": "The affected product is the JAY Login & Register plugin from vendor jayarsiech. All releases up to and including version 2.4.01 are vulnerable. The issue exists in the WordPress environment where this plugin is deployed. No additional products or versions are listed as affected in the available data.", "description_and_impact": "The JAY Login & Register plugin for WordPress includes a critical flaw that allows unauthenticated users to bypass authentication by manipulating a specific cookie. When an attacker sets the 'jay_login_register_process_switch_back' cookie to a valid user ID, the plugin fails to perform a proper authentication check and logs the attacker in as that user. The vulnerability can lead to full administrative access to the site, compromising confidentiality, integrity, and potentially availability if the attacker performs destructive actions. The weakness is classified as CWE\u2011565, reflecting a break in authentication and privilege escalation. The CVSS score of 9.8 indicates a severe threat, underscoring the need for urgent mitigation.", "risk_and_exploitability": "The exploit probability is low as shown by an EPSS score of less than 1%, yet the critical CVSS score and lack of mitigation options keep the risk high. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploits as of the last update. The likely attack vector is remote: an adversary can craft a request or use browser developer tools to set the vulnerable cookie and trigger the authentication bypass. No additional system access or configuration changes are required beyond possessing a valid user identifier, which motivates attackers to enumerate user IDs through other means."}}}}, "created": "2025-12-14T21:15:10.615643+00:00", "updated": "2026-04-21T17:15:25.336534+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}