CVE-2025-8572: Truelysell Core Privilege Escalation Flaw

CVE-2025-8572 Overview

The Truelysell Core plugin for WordPress contains a critical privilege escalation vulnerability affecting versions 1.8.7 and earlier. The vulnerability stems from insufficient validation of the user_role parameter during the user registration process, allowing unauthenticated attackers to create accounts with elevated privileges, including full administrator access to the WordPress installation.

Critical Impact

Unauthenticated attackers can exploit this vulnerability to create administrator accounts, leading to complete site takeover, data theft, malware injection, and defacement of affected WordPress installations.

Affected Products

• Truelysell Core plugin for WordPress versions ≤ 1.8.7
• WordPress sites using the Truelysell service booking theme

Discovery Timeline

• 2026-02-14 - CVE-2025-8572 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2025-8572

Vulnerability Analysis

This privilege escalation vulnerability (CWE-269: Improper Privilege Management) exists due to a fundamental access control weakness in the Truelysell Core plugin's user registration functionality. The plugin fails to properly validate and restrict the user_role parameter when processing new user registrations, allowing attackers to specify arbitrary WordPress roles including administrator.

WordPress uses a role-based access control system where different roles (subscriber, contributor, editor, administrator) have varying levels of capability. The Truelysell Core plugin's registration handler accepts user-supplied role values without verifying that the requested role is appropriate for public registration. This design flaw enables complete bypass of the intended access control model.

Root Cause

The root cause is insufficient input validation and missing authorization checks on the user_role parameter within the plugin's registration functionality. The plugin directly uses user-supplied role data when creating new accounts without verifying that:

1. The role value is restricted to allowed public registration roles
2. The requesting user has appropriate permissions to create accounts with elevated privileges
3. The role assignment follows WordPress security best practices

This allows manipulation of the registration request to specify privileged roles that should only be assignable by existing administrators.

Attack Vector

The attack can be executed remotely over the network without any authentication or user interaction. An attacker crafts a malicious registration request that includes a manipulated user_role parameter set to administrator or other privileged role. When the vulnerable plugin processes this request, it creates a new user account with the attacker-specified elevated privileges.

Once the attacker has administrator access, they can:

• Install malicious plugins or themes containing backdoors
• Modify site content for defacement or phishing
• Access sensitive user data and credentials
• Pivot to attack the underlying server infrastructure
• Use the compromised site for further malicious activities

The vulnerability requires no special conditions to exploit—any WordPress site running a vulnerable version of Truelysell Core with user registration enabled is at risk. For additional technical details, refer to the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-8572

Indicators of Compromise

• Unexpected administrator or editor accounts appearing in the WordPress user database
• New user accounts created with elevated privileges that were not authorized by site administrators
• Anomalous registration activity in WordPress logs, particularly requests containing role manipulation parameters
• Suspicious plugin installations or theme modifications following unauthorized account creation

Detection Strategies

• Monitor WordPress user registration logs for attempts to specify non-default user roles
• Implement Web Application Firewall (WAF) rules to detect and block registration requests containing user_role parameters with privileged values
• Regularly audit the WordPress user list for unauthorized administrator accounts
• Deploy endpoint detection solutions capable of monitoring WordPress file changes and database modifications

Monitoring Recommendations

• Enable detailed logging for WordPress registration events and user creation activities
• Set up alerts for any new administrator account creation outside of approved workflows
• Monitor web server logs for POST requests to registration endpoints containing suspicious parameters
• Implement real-time file integrity monitoring for WordPress core files, plugins, and themes

How to Mitigate CVE-2025-8572

Immediate Actions Required

• Update the Truelysell Core plugin to a patched version newer than 1.8.7 immediately
• Audit all WordPress user accounts and remove any unauthorized administrator accounts
• Review site content and installed plugins for signs of compromise
• Consider temporarily disabling user registration if updates cannot be applied immediately
• Reset passwords for all existing administrator accounts as a precaution

Patch Information

Site administrators should update the Truelysell Core plugin through the WordPress admin dashboard or by downloading the latest version from ThemeForest. Before updating, create a full backup of the WordPress installation including the database.

After applying the update, thoroughly audit existing user accounts to identify and remove any unauthorized privileged accounts that may have been created through exploitation of this vulnerability.

Workarounds

• Disable public user registration on the WordPress site until the plugin can be updated (Settings → General → uncheck "Anyone can register")
• Implement server-level filtering to block registration requests containing role manipulation parameters
• Use a Web Application Firewall (WAF) with rules to detect privilege escalation attempts in form submissions
• Consider deactivating the Truelysell Core plugin temporarily if the functionality is not critical to site operations