An unauthenticated attacker can reset any user account password without requiring a verification token or email confirmation, an issue classified as CWE-307. This enables full account takeover, including administrative control, representing a critical loss of confidentiality, integrity, and availability for affected systems.

The vulnerability affects phpMyFAQ installations running versions prior to 4.1.3, fulfilling the conditions described in the advisory and reachable through the /api/user/password/update endpoint.

The CVSS score of 8.8 indicates high severity, while the EPSS score is unavailable, suggesting that publicly known exploitation data is limited. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through the web API; an attacker may enumerate valid usernames, trigger password resets, capture the new plaintext passwords via email, and then assume full control.