CVE-2025-14975

The Custom Login Page Customizer plugin in WordPress versions up to 2.5.3 is susceptible to privilege escalation through an account takeover attack. The vulnerability arises because the plugin fails to adequately verify a user’s identity before updating passwords. As a result, unauthorized attackers can alter any user's password, including admin accounts, potentially granting them access to those accounts.

Based on public CVE data (MITRE/NVD).