The plugin allows unauthenticated users to change any user's password because it gives user‑controlled access to protected objects, effectively bypassing authorization. If an attacker can reach the page that contains the truelysell_edit_staff shortcode, they can perform a password reset for any account, including administrators, thereby taking over the site. This is a high‑impact flaw that compromises confidentiality, integrity, and availability of the WordPress site via credential takeover.

The vulnerability exists in the Truelysell Core WordPress plugin from dreamstechnologies for all releases up to and including version 1.8.6. Only those installations running 1.8.6 or earlier are affected.

The CVSS score of 9.8 marks this flaw as critical, while the EPSS score of less than 1% indicates that exploitation is currently not widely observed. The flaw is not listed in the CISA KEV catalog. Attackers could exploit it unauthenticated over the Web by accessing the vulnerable shortcode page, so any web‑connected site that has the plugin installed and the shortcode exposed is a potential target. Because the change can be performed by anyone who can reach the page and the password can be set to any value, the risk of credential compromise and full administrative takeover is very high.