CVE-2025-15027Disclosure

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The JAY Login & Register plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.6.03. This is due to the plugin allowing a user to update arbitrary user meta through the 'jay_login_register_ajax_create_final_user' function. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-269

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
8 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 6 signals
Disclosure: 4 classified signals
General: 2 classified signals
Peaked 3d ago at 4 mentions (2026-02-08); latest day: 1
8 total mentions across 4 days

Deep dive

Activity timeline8 mentions / 4d

Signal classification3 categories

Disclosure

450.0%

General

225.0%

Patch

225.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-08	4	Disclosure2General2
2026-02-09	2	Patch2
2026-02-10	1	Disclosure1
2026-02-13	1	Disclosure1

Full discourse8 posts

CRAC Learning - Tech@cracbot238d
Disclosure
CVE-2025-15027 (CVSS:9.8, CRITICAL) is Awaiting Analysis. The JAY Login & Register plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including..https://nvd.nist.gov/vuln/detail/CVE-2025-15027 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The tweet announces CVE-2025-15027, a critical privilege‑escalation flaw in the JAY Login & Register WordPress plugin, and points to the NVD for more details.
0000130
171 followersView on X
transilienceai@transilienceai243d
General
@TheHackerWire - The CVE database entry for CVE-2025-15027
Post summary
The statement merely references the existence of a CVE database entry for CVE‑2025‑15027 without providing additional context or details.
1000043
316 followersView on X
transilienceai@transilienceai243d
General
@TheHackerWire 🚨 #CVE-2025-15027 - JAY Login & Register Plugin Vulnerability 🚨
Post summary
The tweet mentions CVE-2025-15027 for the JAY Login & Register Plugin, but provides no additional details or context.
1000053
316 followersView on X
The Hacker Wire@TheHackerWire243d
Disclosure
🔴 CVE-2025-15027 - Critical The JAY Login & Register plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.6.03. This is due to the plugin allowing a user to update arbit... https://www.thehackerwire.com/vulnerability/CVE-2025-15027/ https://t.co/PjcZzgwHmm
Post summary
The JAY Login & Register plugin for WordPress is disclosed to have a privilege escalation flaw affecting all versions up to 2.6.03, but no PoC, exploit code, or patch information is included.
1000076
112 followersView on X
CVEFind.com@CveFindCom241d
Disclosure
[CVE-2025-15027: CRITICAL] WordPress JAY Login & Register plugin up to v2.6.03 has a Privilege Escalation vulnerability. Attackers can gain admin privileges by exploiting the 'jay_login_register_ajax_create_...#cve,CVE-2025-15027,#cybersecurity https://cvefind.com/CVE-2025-15027
Post summary
The post announces a critical privilege‑escalation vulnerability in WordPress JAY Login & Register plugin up to v2.6.03, noting attackers can gain admin privileges via a specific AJAX function, but it offers no PoC, exploit, or patch details.
0000055
583 followersView on X
PurpleOps@PurpleOps_io242d
Patch
🚨 Critical CVEs Today: WordPress plugin privilege escalation (CVSS 9.8-9.8) Affected: JAY Login & Register Plugin for WordPress (<= 2.6.03) Internet-facing risks dominate, driven by a WordPress plugin flaw that allows unauthenticated privilege escalation. • CVE-2025-15027 (CVSS 9.8) The JAY Login & Register WordPress plugin allows a user to update arbitrary user meta via the jay_login_register_ajax_create_final_user function, enabling unauthenticated privilege escalation to administrator. Affected versions up to 2.6.03. 🛠️ Action • Patch/upgrade to the latest available JAY Login & Register plugin version from WordPress repository. • Prioritize internet-facing instances and edge deployments first. • If a fix is not yet available, apply mitigations and restrict access to the vulnerable feature (disable the AJAX handler). • Add detections for unauthorized user-meta updates and admin privilege escalation attempts. • Hunt for indicators around the affected services during the disclosure-to-now window (logs, EDR, WAF). • Validate remediation (version checks, config verification) and monitor for reversion.
Post summary
The post announces CVE-2025-15027, a privilege escalation flaw in the JAY Login & Register WordPress plugin, and advises patching or disabling the vulnerable AJAX handler to mitigate the issue.
0000072
64 followersView on X
PurpleOps@PurpleOps_io242d
Patch
🚨 Critical CVEs Today: WordPress plugin privilege escalation (CVSS 9.8-9.8) Affected: JAY Login & Register Plugin for WordPress (<= 2.6.03) Internet-facing risks dominate, driven by a WordPress plugin flaw that allows unauthenticated privilege escalation. • CVE-2025-15027 (CVSS 9.8) The JAY Login & Register WordPress plugin allows a user to update arbitrary user meta via the jay_login_register_ajax_create_final_user function, enabling unauthenticated privilege escalation to administrator. Affected versions up to 2.6.03. 🛠️ Action • Patch/upgrade to the latest available JAY Login & Register plugin version from WordPress repository. • Prioritize internet-facing instances and edge deployments first. • If a fix is not yet available, apply mitigations and restrict access to the vulnerable feature (disable the AJAX handler). • Add detections for unauthorized user-meta updates and admin privilege escalation attempts. • Hunt for indicators around the affected services during the disclosure-to-now window (logs, EDR, WAF). • Validate remediation (version checks, config verification) and monitor for reversion.
Post summary
The post announces CVE-2025-15027 affecting the JAY Login & Register WordPress plugin, details an unauthenticated privilege escalation flaw, and provides patching and mitigation guidance.
0000069
64 followersView on X
CVE@CVEnew243d
Disclosure
CVE-2025-15027 The JAY Login & Register plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.6.03. This is due to the plugin allowing a… https://www.cve.org/CVERecord?id=CVE-2025-15027
Post summary
The CVE-2025-15027 entry reports a privilege escalation flaw in the JAY Login & Register WordPress plugin up to version 2.6.03, with no PoC or patch information provided.
00000204
56.5K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2025-15027

transilienceai[verified]@transilienceaiGeneral

The statement merely references the existence of a CVE database entry for CVE‑2025‑15027 without providing additional context or details.

transilienceai[verified]@transilienceaiGeneral

The tweet mentions CVE-2025-15027 for the JAY Login & Register Plugin, but provides no additional details or context.

PurpleOps[verified]@PurpleOps_ioPatch

The post announces CVE-2025-15027, a privilege escalation flaw in the JAY Login & Register WordPress plugin, and advises patching or disabling the vulnerable AJAX handler to mitigate the issue.

PurpleOps[verified]@PurpleOps_ioPatch

The post announces CVE-2025-15027 affecting the JAY Login & Register WordPress plugin, details an unauthenticated privilege escalation flaw, and provides patching and mitigation guidance.

CRAC Learning - Tech@cracbotDisclosure

The tweet announces CVE-2025-15027, a critical privilege‑escalation flaw in the JAY Login & Register WordPress plugin, and points to the NVD for more details.

The Hacker Wire@TheHackerWireDisclosure

The JAY Login & Register plugin for WordPress is disclosed to have a privilege escalation flaw affecting all versions up to 2.6.03, but no PoC, exploit code, or patch information is included.

CVEFind.com@CveFindComDisclosure

The post announces a critical privilege‑escalation vulnerability in WordPress JAY Login & Register plugin up to v2.6.03, noting attackers can gain admin privileges via a specific AJAX function, but it offers no PoC, exploit, or patch details.

CVE@CVEnewDisclosure

The CVE-2025-15027 entry reports a privilege escalation flaw in the JAY Login & Register WordPress plugin up to version 2.6.03, with no PoC or patch information provided.