The Directorist WordPress plugin versions up to 8.1 contain a weakness in their password recovery mechanism (CWE-640). Specifically, the functions directorist_generate_password_reset_pin_code() and reset_user_password() do not adequately restrict or verify OTP usage, allowing unauthenticated attackers to brute force the OTP and reset passwords of any user account, including administrators. This results in privilege escalation via account takeover. The CVSS 3.1 base score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating a high-severity remote vulnerability requiring high attack complexity but no privileges or user interaction.

Successful exploitation allows an unauthenticated attacker to reset passwords of any user account, including administrators, leading to full account takeover and complete compromise of the affected WordPress site. This impacts confidentiality, integrity, and availability of the system. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the password reset functionality if possible and monitor for suspicious password reset attempts. Avoid using affected plugin versions and consider disabling the plugin temporarily if feasible.