Critical severity · published Feb 14, 2026
CVE-2025-8572
Truelysell Core <= 1.8.7 - Unauthenticated Privilege Escalation via Registration
9.8
CVSS
0.5%
EPSS
No
On KEV
Description
The Truelysell Core plugin for WordPress is vulnerable to privilege escalation in versions less than, or equal to, 1.8.7. This is due to insufficient validation of the user_role parameter during user registration. This makes it possible for unauthenticated attackers to create accounts with elevated privileges, including administrator access.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TC
Truelysell Core · dreamstechnologies
through 1.8.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-8572
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-8572
themeforest.net
https://themeforest.net/item/truelysell-service-booking-wordpress-theme/43398124
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/b027c9f9-3144-4783-b646-ee1e02cd27ef?source=cve
More from Truelysell Core
9.8
CVE-2025-10742
Truelysell Core <= 1.8.6 - Unauthenticated Arbitrary User Password Change