Privilege Escalation Vulnerability in Truelysell Core Plugin for WordPress
CVE-2025-8572

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Truelysell Core
Vendor
CVE Published:
14 February 2026

What is CVE-2025-8572?

The Truelysell Core plugin for WordPress exhibits a security flaw that allows unauthenticated attackers to escalate their privileges due to inadequate validation of the user_role parameter during the user registration process. This vulnerability affects versions 1.8.7 and earlier, enabling unauthorized users to create accounts with higher privileges, including administrative rights. Website administrators should apply the necessary updates to mitigate potential security risks and safeguard their sites.

Affected Version(s)

Truelysell Core 0 <= 1.8.7

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://themeforest.net/item/truelysell-service-booking-w...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alyudin Nafiie
.