Arbitrary User Password Change Vulnerability in Truelysell Core Plugin for WordPress

CVE-2025-10742

What is CVE-2025-10742?

The Truelysell Core plugin for WordPress introduces a security flaw that allows unauthorized users to change passwords of existing accounts. This vulnerability arises from insufficient access controls, enabling attackers to exploit the 'truelysell_edit_staff' shortcode without authentication. Consequently, unauthenticated individuals can manipulate user passwords, which poses a significant risk of unauthorized account access, including the potential compromise of administrator privileges. Website owners using affected plugin versions are urged to implement security measures and update to the latest version to safeguard their systems.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References