CVE-2025-14975

The Custom Login Page Customizer WordPress plugin (versions before 2.5.4 ) contains an unauthenticated account takeover vulnerability due to Reset-Key Poisoning . When the "custom registration password" feature is enabled, the plugin adds a global random_password filter that incorrectly returns a...