CVE-2025-8572

Truelysell Core <= 1.8.7 - Unauthenticated Privilege Escalation via Registration

Published Feb 14, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

The Truelysell Core plugin for WordPress is vulnerable to privilege escalation in versions less than, or equal to, 1.8.7. This is due to insufficient validation of the user_role parameter during user registration. This makes it possible for unauthenticated attackers to create accounts with elevated privileges, including administrator access.

Analysis

Technical impact

The Truelysell Core plugin for WordPress is vulnerable to unauthenticated privilege escalation in versions 1.8.7 and earlier. The flaw arises from insufficient validation of the user_role parameter during user registration, allowing attackers to create new accounts with elevated privileges, including administrator. This vulnerability is classified as CWE‑269 and grants an attacker full control over the affected WordPress site.

Affected Systems

The affected product is the Truelysell Core plugin by DreamTechnologies, used in WordPress installations. Versions equal to or earlier than 1.8.7 are impacted.

Risk and Exploitability

The CVSS score is 9.8 (Critical), indicating a severe risk. The EPSS score of <1% suggests that widespread exploitation is unlikely at present, and the vulnerability is not listed in CISA KEV. The likely attack vector is a public registration endpoint that accepts a user_role parameter without proper validation. Attackers can target any WordPress site running the vulnerable plugin, creating an account with administrator rights.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

dreamstechnologies

Truelysell Core

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.8.7

No data.

Vendor Product Versions

Dreamstechnologies

Truelysell Core

Version	Status	Scheme	Platform
`[0,1.8.7]`	affected	semver	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Truelysell Core to version 1.8.8 or later to apply the vendor fix.
If an immediate update is not possible, disable new user registration through WordPress settings or remove the registration form from the site until the plugin is updated.
As a temporary workaround, configure the plugin or use a filter to force the role assigned to new registrations to the lowest level (subscriber).
Verify that no other plugins or custom code modify the user_role during registration, and consider using a web application firewall rule to block attempts to supply a user_role parameter.

Generated by OpenCVE AI on April 20, 2026 at 18:49 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.487% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://themeforest.net/item/truelysell-service-booking-wordpress-theme/43398124
https://www.wordfence.com/threat-intel/vulnerabilities/id/b027c9f9-3144-4783-b646-ee1e02cd27ef?source=cve

History

Feb 17, 2026 4:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Feb 16, 2026 12:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Dreamstechnologies Dreamstechnologies truelysell Core Wordpress Wordpress wordpress
Vendors & Products		Dreamstechnologies Dreamstechnologies truelysell Core Wordpress Wordpress wordpress

Feb 14, 2026 8:30 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Truelysell Core plugin for WordPress is vulnerable to privilege escalation in versions less than, or equal to, 1.8.7. This is due to insufficient validation of the user_role parameter during user registration. This makes it possible for unauthenticated attackers to create accounts with elevated privileges, including administrator access.
Title		Truelysell Core <= 1.8.7 - Unauthenticated Privilege Escalation via Registration
Weaknesses		CWE-269
References		https://themeforest.net/item/truelysell-service-booking-wordpress-theme/43398124 https://www.wordfence.com/threat-intel/vulnerabilities/id/b027c9f9-3144-4783-b646-ee1e02cd27ef?source=cve
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`