Truelysell Core <= 1.8.7 - 登録による認証されていない権限昇格

Successful exploitation of CVE-2025-8572 allows an unauthenticated attacker to register a new user account and assign themselves an elevated role, including administrator. This grants complete control over the WordPress site, enabling the attacker to modify content, install malicious plugins, steal sensitive data (user credentials, customer information, financial data), and potentially compromise the entire server. The impact is particularly severe for WordPress sites hosting e-commerce functionality or containing sensitive user data, as the attacker can directly manipulate the database and system configurations.

1. 予約済み2025-08-04
2. 公開日2026-02-14
3. 更新日2026-04-08
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2025-8572 is to immediately upgrade the Truelysell Core plugin to version 1.8.8 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling user registration on the WordPress site to prevent new account creation. While not a complete solution, implementing a Web Application Firewall (WAF) with rules to block suspicious user registration attempts can provide an additional layer of defense. Review WordPress user accounts for any unexpected administrator accounts.