FS Registration Password
FS Registration Password has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of September 2026. Their average CVSS score is 9.8, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high.
The most common weakness is Authorization Bypass Through User-Controlled Key, behind 1 of the records (100%).
The one issue recorded for FS Registration Password has a vendor fix available, so running the current release closes it.
All of these findings were reported by Drew Webber (mcdruid). FS Registration Password is installed on roughly 40 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2025-15001FS Registration Password <= 1.0.1 - Unauthenticated Privilege Escalation via Account Takeover
Read the full analysisVulnerability Records
FS Registration Password
Author
Firdaus Zahari
This plugin allows users to set their passwords during the registration process. Once activated, a password field will appear on the registration field which uses the same functionality as the password field you get when you’re resetting your password. The email notification sent to the new user is also modified to indicate a successful password set.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C