CVE-2025-46535 Overview
CVE-2025-46535 is a Missing Authorization vulnerability [CWE-862] in the AlphaEfficiencyTeam Custom Login and Registration plugin for WordPress. The flaw affects all versions up to and including 1.0.0. The plugin exposes functionality protected by incorrectly configured access control checks, allowing authenticated users with low privileges to perform actions that should be restricted. The issue is documented in the Patchstack WordPress Vulnerability Report.
Critical Impact
Authenticated attackers with minimal privileges can access plugin functionality that lacks proper authorization checks, resulting in limited integrity and availability impact on affected WordPress sites.
Affected Products
- AlphaEfficiencyTeam Custom Login and Registration plugin for WordPress
- All versions from n/a through 1.0.0
- WordPress sites with the ms-registration plugin installed
Discovery Timeline
- 2025-04-25 - CVE-2025-46535 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-46535
Vulnerability Analysis
The vulnerability stems from missing authorization controls in the Custom Login and Registration plugin. The plugin exposes actions or endpoints that fail to verify whether the requesting user holds the required capabilities. An authenticated user with low-tier privileges can invoke these endpoints and trigger operations reserved for higher-privileged accounts.
The attack requires network access and low privileges. No user interaction is needed. Confidentiality is not affected, but integrity and availability can be partially impacted. The scope remains unchanged, meaning the impact stays within the vulnerable component.
The EPSS probability sits at 0.271% with a percentile of 19.56, indicating a low predicted likelihood of exploitation in the near term.
Root Cause
The root cause is an incorrectly configured access control check [CWE-862]. The plugin registers handlers that do not verify the caller's WordPress role or capability. This omission allows any authenticated session to reach protected code paths.
Attack Vector
An attacker authenticates to the target WordPress site with any valid account, including low-privilege roles such as subscriber. The attacker then issues a crafted request to a plugin endpoint that omits the required capability check. The plugin executes the requested action without validating authorization.
No public proof-of-concept code is available. See the Patchstack advisory for additional technical context.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2025-46535
Indicators of Compromise
- Unexpected changes to user accounts, roles, or registration data on WordPress sites running the ms-registration plugin
- WordPress access logs showing low-privileged users invoking plugin endpoints associated with administrative or registration functionality
- New or modified WordPress users created outside normal registration workflows
Detection Strategies
- Audit installed WordPress plugins for ms-registration (Custom Login and Registration) at version 1.0.0 or earlier
- Review web server logs for POST requests to plugin action handlers originating from subscriber-level accounts
- Correlate authentication events with subsequent privileged actions performed by non-administrator users
Monitoring Recommendations
- Enable WordPress audit logging to capture role changes, user creation, and plugin action invocations
- Forward WordPress and web server logs to a centralized SIEM for correlation and alerting on anomalous plugin usage
- Alert on any capability escalation or unexpected privileged operations tied to low-privileged sessions
How to Mitigate CVE-2025-46535
Immediate Actions Required
- Identify all WordPress instances running the Custom Login and Registration plugin at version 1.0.0 or earlier
- Deactivate and remove the plugin until a patched release is available from the vendor
- Review user accounts and audit logs for signs of unauthorized activity or role changes
Patch Information
No patched version has been published at the time of the NVD advisory. The vulnerability affects Custom Login and Registration from n/a through 1.0.0. Monitor the Patchstack advisory and the WordPress plugin repository for an updated release.
Workarounds
- Uninstall the plugin and use an alternative login and registration solution with maintained security updates
- Restrict user registration on affected sites and limit account creation to trusted administrators
- Deploy a Web Application Firewall (WAF) rule to block requests to vulnerable plugin endpoints from non-administrator sessions
# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate ms-registration
wp plugin uninstall ms-registration
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
