CVE-2023-1888

CVE-2023-1888 is a critical vulnerability affecting the Directorist plugin for WordPress, specifically versions up to and including 7.5.4. This flaw, stemming from insufficient validation in login.php, allows authenticated attackers with subscriber-level permissions or higher to reset the password of any user, potentially leading to full administrative control. With a CVSS score of 8.8 (High), the vulnerability is easily exploitable over the network with low complexity and no user interaction required, posing a significant risk of complete compromise of confidentiality, integrity, and availability. While there is currently no evidence of active exploitation, public exploit code, or significant community discussion, the potential for privilege escalation makes this a serious concern for affected WordPress installations.