CVE-2025-3605: Frontend Login and Registration Blocks <= 1.0.7 - Unauthenticated Privilege Escalation via Account Takeover
First published: Fri May 09 2025(Updated: )
The Frontend Login and Registration Blocks plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.7. This is due to the plugin not properly validating a user's identity prior to updating their details like email via the flr_blocks_user_settings_handle_ajax_callback() function. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WordPress Frontend Login and Registration Blocks | <=1.0.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-3605?
CVE-2025-3605 is classified as a privilege escalation vulnerability that can lead to account takeover.
How do I fix CVE-2025-3605?
To remediate CVE-2025-3605, update the Frontend Login and Registration Blocks plugin to version 1.0.8 or higher.
Which versions are affected by CVE-2025-3605?
CVE-2025-3605 affects all versions of the Frontend Login and Registration Blocks plugin up to and including 1.0.7.
What impact does CVE-2025-3605 have on users?
CVE-2025-3605 allows an attacker to potentially take over a user account by manipulating account details.
Who is impacted by CVE-2025-3605?
Users of the Frontend Login and Registration Blocks plugin for WordPress versions 1.0.7 and earlier are impacted by CVE-2025-3605.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- agent/last-modified-date
- agent/source
- agent/tags
- agent/event
- vendor/wordpress
- canonical/wordpress frontend login and registration blocks