PT-2026-8095 · WordPress · Truelysell Core

Alyudin Nafiie · Published 2026-02-14 · Updated 2026-02-15 · CVE-2025-8572

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Truelysell Core plugin for WordPress versions prior to 1.8.7

Description The Truelysell Core plugin for WordPress is subject to a privilege escalation issue. Insufficient validation of the user role parameter during user registration allows unauthenticated attackers to create accounts with elevated privileges, potentially including administrator access.

Recommendations Update the Truelysell Core plugin to a version greater than 1.8.7.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-8572

Affected Products

Truelysell Core

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-8572 · Security Note
• https://twitter.com/VulmonFeeds/status/2022637695957127339 · Twitter Post
• https://twitter.com/TheHackerWire/status/2022600989161955437 · Twitter Post
• https://themeforest.net/item/truelysell-service-booking-wordpress-theme/43398124 · Note
• https://twitter.com/CVEnew/status/2022596057469706645 · Twitter Post
• https://twitter.com/0dayPublishing/status/2023156408871473362 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/b027c9f9-3144-4783-b646-ee1e02cd27ef?source=cve · Note
• https://t.me/cveNotify/152030 · Telegram Post
• https://t.me/CVEtracker/44714 · Telegram Post