CVE-2025-15100 in JAY Login & Register Plugin
Summary
by MITRE • 02/08/2026
The JAY Login & Register plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.6.03. This is due to the plugin allowing a user to update arbitrary user meta through the 'jay_panel_ajax_update_profile' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 02/09/2026
The CVE-2025-15100 vulnerability affects the JAY Login & Register plugin for WordPress, representing a critical privilege escalation flaw that undermines the security model of WordPress installations. This vulnerability exists within all versions up to and including 2.6.03, making it a widespread concern for WordPress users who rely on this plugin for user authentication and registration functionalities. The flaw stems from inadequate input validation and access control mechanisms within the plugin's core functionality, specifically targeting the administrative privilege structure that WordPress employs to maintain security boundaries between different user roles.
The technical implementation of this vulnerability occurs through the 'jay_panel_ajax_update_profile' function which fails to properly validate or sanitize user inputs before processing them as user metadata updates. This function exposes a direct pathway for authenticated users to manipulate user meta data fields without proper authorization checks. When an attacker with subscriber-level access or higher invokes this function, they can exploit the missing validation controls to modify user capabilities and elevate their privileges to administrator status. The vulnerability essentially bypasses WordPress's built-in role-based access control system by allowing direct manipulation of user meta fields that contain capability information.
The operational impact of this vulnerability is severe as it provides attackers with a straightforward method to gain complete administrative control over WordPress installations. An attacker with minimal privileges can leverage this flaw to escalate their access level and subsequently gain full control over the entire WordPress environment. This includes the ability to modify or delete content, install malicious plugins, modify themes, access sensitive user data, and potentially use the compromised site as a pivot point for attacking other systems within the network. The vulnerability is particularly dangerous because it requires only authenticated access, meaning that attackers who have already gained a low-level user account can quickly escalate their privileges without requiring additional attack vectors.
This vulnerability maps directly to CWE-269: "Improper Privilege Management" and aligns with ATT&CK technique T1078.004: "Valid Accounts: Cloud Accounts" in the context of privilege escalation within web applications. The flaw demonstrates poor input validation practices and inadequate access control enforcement, which are fundamental security principles that should be implemented at every layer of application development. Organizations using this plugin should immediately implement mitigations including disabling the vulnerable plugin until a patched version is available, implementing additional access controls, and monitoring for unauthorized privilege changes in user accounts. The recommended remediation involves updating to the latest version of the plugin where the vulnerability has been addressed through proper input validation and access control mechanisms that prevent unauthorized modification of user capability metadata.
The exploitation of this vulnerability can lead to complete compromise of WordPress installations and potentially broader network infrastructure if the compromised site serves as a gateway to other systems. Security professionals should conduct immediate assessments of all WordPress installations using this plugin to identify affected versions and implement immediate defensive measures. The vulnerability underscores the critical importance of regular security updates and proper input validation in web application development, particularly for authentication and authorization related functionalities that directly impact system security boundaries.