CVE-2025-3605 — AI Deep Analysis Summary

🚨 **Essence:** Critical flaw in WordPress plugin 'Frontend Login and Registration Blocks'. 💥 **Consequences:** Unauthenticated attackers can take over admin accounts.…

🛡️ **Root Cause:** CWE-639 (Authorization Bypass). The plugin fails to validate user identity when updating sensitive data (like email) via AJAX.

📦 **Affected:** WordPress Plugin: 'Frontend Login and Registration Blocks' (also listed as 'Login, Registration and Lost Password Blocks'). 📉 **Version:** 1.0.7 and earlier.

🔓 **Attacker Actions:** Change the Administrator's email address ➡️ Trigger 'Forgot Password' ➡️ Reset Admin Password. Result: **Full Admin Control**.

⚡ **Threshold:** LOW. No authentication required (PR:N). Low complexity (AC:L). No user interaction needed (UI:N). Easy to exploit remotely.

💣 **Public Exploits:** YES. Multiple PoCs available on GitHub (Nxploited, GadaLuBau1337) and Nuclei templates. Active wild exploitation risk is HIGH.

🔍 **Self-Check:** Scan for the AJAX endpoint `flr_blocks_user_settings_handle_ajax_callback()`. Check if the plugin version is <= 1.0.7. Use Nuclei templates for automated detection.

🩹 **Official Fix:** The description implies the vulnerability exists in versions <= 1.0.7. You must update to a patched version (likely > 1.0.7) or disable the plugin immediately.

🚧 **No Patch Workaround:** Disable the 'Frontend Login and Registration Blocks' plugin entirely. Restrict access to the `flr_blocks_user_settings_handle_ajax_callback` endpoint via WAF if possible.

🔥 **Urgency:** CRITICAL. CVSS Score is HIGH (likely 9.8 based on vector). Immediate action required to prevent account takeover. Patch or disable NOW.