← back to popular plugins
wordfence / plugin · login-customizer
Custom Login Page Customizer
login-customizer
total installs
90,000
total vulns
1
critical
1
high
0
medium
0
low
0
latest vuln
—
patched
1
unpatched
0
avg time to patch
—
vulnerabilities
(1)
Custom Login Page Customizer <= 2.5.3 - Unauthenticated Privilege Escalation via Password Reset
critical
✓ patched
cve id
CVE-2025-14975 ↗
cvss score
9.8
cwe
CWE-269: Improper Privilege Management
published
Jan 8, 2026
The Custom Login Page Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.5.3. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.