CVE-2025-10742Critical· 9.8▾ Midnight

The Truelysell Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.8.6

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score54/ 100 · Moderate

impact 53.9 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Oct 16, 2025

Updated

Oct 8, 2026

CVSS

9.8

Vendor

—

Product

—

CWE

CWE-639

Depth score

54 · Moderate

EPSS

0.54% · p44

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 357 days

Oct 16, 2025Published
Disclosed via NVD
Oct 8, 2026Record revised
Last analysed / modified upstream
Oct 8, 2026EPSS first tracked
0.5%

CWE-639 #nvd

Full technical detail▾

Overview

The Truelysell Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.8.6. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts. Note: This can only be exploited unauthenticated if the attacker knows which page contains the 'truelysell_edit_staff' shortcode.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd

← Back to feed