CVE-2025-14975

The Custom Login Page Customizer WordPress plugin (versions before 2.5.4 ) is vulnerable to an unauthenticated account takeover via Reset-Key Poisoning . The root cause is a global random_password filter (in src/Settings/Features/Custom_Register_Password.php:33) that returns attacker-supplied $_P...