PT-2026-8095 · WordPress · Truelysell Core

Alyudin Nafiie · Publicado 2026-02-14 · Atualizado 2026-02-15 · CVE-2025-8572

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Truelysell Core plugin for WordPress versions prior to 1.8.7

Description The Truelysell Core plugin for WordPress is subject to a privilege escalation issue. Insufficient validation of the user role parameter during user registration allows unauthenticated attackers to create accounts with elevated privileges, potentially including administrator access.

Recommendations Update the Truelysell Core plugin to a version greater than 1.8.7.

Correção

LPE

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2025-8572

Produtos afetados

Truelysell Core

Referências · 9

• https://twitter.com/VulmonFeeds/status/2022637695957127339 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2022600989161955437 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-8572 · Nota de Segurança
• https://themeforest.net/item/truelysell-service-booking-wordpress-theme/43398124 · Nota
• https://twitter.com/CVEnew/status/2022596057469706645 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/2023156408871473362 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/b027c9f9-3144-4783-b646-ee1e02cd27ef?source=cve · Nota
• https://t.me/cveNotify/152030 · Publicação no Telegram
• https://t.me/CVEtracker/44714 · Publicação no Telegram