CVE-2025-14996

🗓️ 06 Jan 2026 04:31:54Reported by WordfenceType

CVE-2025-14996: Unauthenticated privilege escalation via password changes in the AS Password Field plugin up to 2.0.0.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-14996	6 Jan 202605:43	–	circl
CNNVD	WordPress plugin AS Password Field In Default Registration Form 安全漏洞	6 Jan 202600:00	–	cnnvd
Cvelist	CVE-2025-14996 AS Password Field In Default Registration Form <= 2.0.0 - Unauthenticated Privilege Escalation via Account Takeover	6 Jan 202604:31	–	cvelist
EUVD	EUVD-2026-1078	6 Jan 202604:31	–	euvd
NVD	CVE-2025-14996	6 Jan 202605:15	–	nvd
Patchstack	WordPress AS Password Field In Default Registration Form plugin <= 2.0.0 - Unauthenticated Privilege Escalation via Account Takeover vulnerability	6 Jan 202606:12	–	patchstack
Positive Technologies	PT-2026-1413	6 Jan 202600:00	–	ptsecurity
RedhatCVE	CVE-2025-14996	7 Jan 202609:12	–	redhatcve
Vulnrichment	CVE-2025-14996 AS Password Field In Default Registration Form <= 2.0.0 - Unauthenticated Privilege Escalation via Account Takeover	6 Jan 202604:31	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (January 5, 2026 to January 11, 2026)	15 Jan 202616:14	–	wordfence

Vulners

Node

aksharsoftsolutions as_password_field_in_default_registration_formRange≤2.0.0wordpress

[
  {
    "vendor": "aksharsoftsolutions",
    "product": "AS Password Field In Default Registration Form",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.0.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/as-password-field-in-default-registration-form/tags/2.0.0/as-password-field-default-registration.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/061f022b-b922-4499-bb34-8ea91ba5ace3

15 Apr 2026 00:35Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.19.8

EPSS0.00187

SSVC

CWE-639