A critical vulnerability in the FS Registration Password plugin allows unauthenticated attackers to hijack any WordPress account, including administrator accounts, through unauthorized password resets.

The vulnerability is an authorization bypass (CWE-639) occurring within the plugin authentication logic, which fails to verify user identity before performing password modifications. This flaw allows unauthenticated remote attackers to execute account takeovers by manipulating the password change process.

Successful exploitation grants an attacker full administrative control over the affected WordPress site. This leads to complete compromise of site data, potential malware injection, unauthorized access to user information, and significant reputational damage. Given the CVSS score of 9.8, this vulnerability is classified as critical, as it requires no privileges and permits total system takeover.

Immediate Action: Since a specific patched version is not explicitly identified in the provided data, users should immediately deactivate and remove the FS Registration Password plugin until a secure update is verified and released by the vendor.

Proactive Monitoring: Review WordPress user account logs for unexpected password changes or the creation of new administrator accounts. Monitor for anomalous traffic targeting the plugin authentication endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized requests to the registration or password reset parameters of the affected plugin.

Public Exploit Available: Unknown.

The severity of this vulnerability necessitates immediate action to prevent full site compromise. Administrators must prioritize the removal of the vulnerable plugin to mitigate the risk of unauthorized administrative access until a verified fix is available. Continued vigilance regarding user account activity is essential for detecting potential exploitation attempts.