CVE-2025-10742
Published: 16 October 2025
Description
Adversaries may manipulate accounts to maintain and/or elevate access to victim systems.
Security Summary
CVE-2025-10742 is an authorization bypass vulnerability in the Truelysell Core plugin for WordPress, affecting versions up to and including 1.8.6. It enables arbitrary user password changes due to the plugin providing user-controlled access to objects, allowing attackers to bypass authorization checks and access system resources. The issue is classified under CWE-639 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity with network accessibility, low complexity, and no privileges required.
Unauthenticated attackers can exploit this vulnerability if they know the specific page containing the 'truelysell_edit_staff' shortcode. Successful exploitation allows them to change passwords of any user, including administrators, potentially leading to full account takeover and unauthorized control over the WordPress site.
Advisories and further details, including potential mitigation guidance, are available from Wordfence threat intelligence and the Truelysell theme page on ThemeForest.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
T1190 directly matches exploitation of a public-facing WordPress plugin vulnerability. T1098 is facilitated by the ability to arbitrarily change any user password, enabling account manipulation and takeover.