Truelysell Core <= 1.8.7 - Unauthenticated Privilege Escalation via Registration

The impact of CVE-2025-8572 is severe. Successful exploitation allows an attacker to create a new user account with elevated privileges, effectively bypassing standard WordPress access controls. This grants the attacker complete control over the WordPress site, including the ability to modify content, install malicious plugins, access sensitive data, and potentially compromise the entire server. The lack of authentication required for exploitation significantly broadens the attack surface, making the vulnerability particularly dangerous. A malicious actor could leverage this to deface the website, steal user data (including credentials), or use the compromised site as a launchpad for further attacks against internal systems.

1. Reserviert2025-08-04
2. Veröffentlicht2026-02-14
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-8572 is to immediately upgrade the Truelysell Core plugin to version 1.8.8 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider temporarily disabling user registration on the WordPress site to prevent new account creation. While not a complete solution, this can reduce the immediate risk. Review existing user accounts for any suspicious activity and consider implementing stricter password policies. Monitor WordPress access logs for unusual login attempts or account creation patterns.