CVE-2025-10742
|
| |
|
|
Software afectado |
WORDPRESS |
|
|
|
The Truelysell Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.8.6. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts. Note: This can only be exploited unauthenticated if the attacker knows which page contains the 'truelysell_edit_staff' shortcode. |
Link: |
| https://nvd.nist.gov/vuln/detail/CVE-2025-10742 |
