CVE-2025-14440 — AI Deep Analysis Summary

Q: Who is affected? (Versions/Components)

📦 **Affected**: WordPress Plugin **JAY Login & Register**. 📉 **Version**: **2.4.01** and earlier. 🏢 **Vendor**: jayarsiech. If you use this plugin, you are vulnerable.

Q: Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: **LOW**. 🌐 **Network**: Attack Vector is **Network** (AV:N). 🔑 **Auth**: **None** required (PR:N). 👀 **UI**: **None** required (UI:N). Easy to exploit remotely.

Q: Is there a public Exp? (PoC/Wild Exploitation)

💣 **Exploit**: **YES**. Public PoC exists. 🔗 **Link**: [GitHub PoC](https://github.com/Nxploited/CVE-2025-14440). ⚠️ **Method**: Exploits via **Cookie** manipulation. Wild exploitation is likely imminent.

Q: How to self-check? (Features/Scanning)

🔍 **Check**: Scan for plugin **JAY Login & Register**. 📊 **Version**: Verify if version is **≤ 2.4.01**. 🛠️ **Tool**: Use WPScan or manual code review of `jay-login-register-user-switching.php` around line 98.

Q: Is it fixed officially? (Patch/Mitigation)

🩹 **Fix**: **YES**. Patch available. 🔗 **Source**: [WordPress Trac Changeset 3418754](https://plugins.trac.wordpress.org/changeset/3418754/). ✅ **Action**: Update plugin immediately to the latest version.

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. 🚨 **Priority**: **P0**. ⏱️ **Time**: Patch **NOW**. CVSS Score is **High** (9.8+ implied by vector). Do not wait.

Updated May 08, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Critical Auth Bypass in **JAY Login & Register** plugin. <br>💥 **Consequences**: Attackers can bypass login checks entirely. Full system compromise is possible.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: Flawed authentication logic in `jay_login_register_process_switch_back` function. <br>🔍 **CWE**: **CWE-565** (Information Exposure Through User-Friendly Error Messages / Improper Authentication).…

Read full answer (login)

Q3Who is affected? (Versions/Components)

📦 **Affected**: WordPress Plugin **JAY Login & Register**. <br>📉 **Version**: **2.4.01** and earlier. <br>🏢 **Vendor**: jayarsiech. If you use this plugin, you are vulnerable.

Q4What can hackers do? (Privileges/Data)

👑 **Privileges**: Attackers gain **unauthorized access**. <br>📂 **Data**: Full read/write access to user accounts. <br>🔓 **Impact**: High Confidentiality, Integrity, and Availability loss.…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: **LOW**. <br>🌐 **Network**: Attack Vector is **Network** (AV:N). <br>🔑 **Auth**: **None** required (PR:N). <br>👀 **UI**: **None** required (UI:N). Easy to exploit remotely.

Q6Is there a public Exp? (PoC/Wild Exploitation)

💣 **Exploit**: **YES**. Public PoC exists. <br>🔗 **Link**: [GitHub PoC](https://github.com/Nxploited/CVE-2025-14440). <br>⚠️ **Method**: Exploits via **Cookie** manipulation. Wild exploitation is likely imminent.

Q7How to self-check? (Features/Scanning)

🔍 **Check**: Scan for plugin **JAY Login & Register**. <br>📊 **Version**: Verify if version is **≤ 2.4.01**. <br>🛠️ **Tool**: Use WPScan or manual code review of `jay-login-register-user-switching.php` around line 98.

Q8Is it fixed officially? (Patch/Mitigation)

🩹 **Fix**: **YES**. Patch available. <br>🔗 **Source**: [WordPress Trac Changeset 3418754](https://plugins.trac.wordpress.org/changeset/3418754/). <br>✅ **Action**: Update plugin immediately to the latest version.

Q9What if no patch? (Workaround)

🚧 **No Patch?**: Disable the plugin immediately. <br>🔒 **Mitigation**: Remove `jay-login-register` folder. <br>📝 **Workaround**: If critical, implement strict cookie validation manually (not recommended).…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. <br>🚨 **Priority**: **P0**. <br>⏱️ **Time**: Patch **NOW**. CVSS Score is **High** (9.8+ implied by vector). Do not wait.

Continue exploring

Vulnerability detail Full AI analysis (login) jayarsiech CWE-565