CVE-2025-8572 - Vulnerability Analysis
CriticalCVSS: 9.8Last Updated: February 14, 2026
Truelysell Core - Privilege Escalation
Overview
Truelysell Core WordPress plugin <= 1.8.7 contains a privilege escalation caused by insufficient validation of the user_role parameter during user registration, letting unauthenticated attackers create accounts with elevated privileges.
Severity & Score
Impact
Unauthenticated attackers can create accounts with administrator privileges, compromising site security.
Mitigation
Update to a version later than 1.8.7 or the latest available version.
References
Social Media Activity(2 posts)
š“ CVE-2025-8572 - Critical (9.8) The Truelysell Core plugin for WordPress is vulnerable to privilege escalation in versions less than, or equal to, 1.8.7. This is due to insufficient validation of the user_role parameter during user registration. This makes it possible for unauth... š https://www.thehackerwire.com/vulnerability/CVE-2025-8572/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
View original post
š“ CVE-2025-8572 - Critical (9.8) The Truelysell Core plugin for WordPress is vulnerable to privilege escalation in versions less than, or equal to, 1.8.7. This is due to insufficient validation of the user_role parameter during user registration. This makes it possible for unauth... š https://www.thehackerwire.com/vulnerability/CVE-2025-8572/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
View original postGitHub Repositories(1 repo)
Related Resources
Details
- CVE ID
- CVE-2025-8572
- Severity
- Critical
- CVSS Score
- 9.8
- Type
- broken_access_control
- Status
- new
- EPSS
- 4.0%
- Social Posts
- 2
CWE
- CWE-269
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H