Arbitrary User Password Change Vulnerability in Truelysell Core Plugin for WordPress

CVE-2025-10742

What is CVE-2025-10742?

The Truelysell Core plugin for WordPress introduces a security flaw that allows unauthorized users to change passwords of existing accounts. This vulnerability arises from insufficient access controls, enabling attackers to exploit the 'truelysell_edit_staff' shortcode without authentication. Consequently, unauthenticated individuals can manipulate user passwords, which poses a significant risk of unauthorized account access, including the potential compromise of administrator privileges. Website owners using affected plugin versions are urged to implement security measures and update to the latest version to safeguard their systems.

References