VulnSocial

CVE-2025-8572Disclosure

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

The Truelysell Core plugin for WordPress is vulnerable to privilege escalation in versions less than, or equal to, 1.8.7. This is due to insufficient validation of the user_role parameter during user registration. This makes it possible for unauthenticated attackers to create accounts with elevated privileges, including administrator access.

Back to dashboard
2.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-269

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 5 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 5 signals
  • Disclosure: 5 classified signals
  • Peaked 1d ago at 4 mentions (2026-02-14); latest day: 1
  • 5 total mentions across 2 days

Deep dive

Activity timeline5 mentions / 2d
01234Mentions · 2026-02-14: 4Mentions · 2026-02-15: 1PoC Mentioned / Linked · 2026-02-15: 1Patch / Workaround · 2026-02-14: 1Technical Details · 2026-02-14: 4Technical Details · 2026-02-15: 102-1402-15
Signal classification1 categories
Disclosure
5100.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-02-144
Disclosure4
2026-02-151
Disclosure1
Full discourse5 posts
  • 0day Signal@0dayPublishing
    Disclosure

    🚨 CVE-2025-8572: Truelysell Core <= 1.8.7 - Unauth... Classic parameter validation fail in Truelysell Core lets anyone create admin accounts by simply manipulating the user_r... https://zerodaysignal.com/vulnerability/CVE-2025-8572 #netsec #vulnerability #CVE #sysadmin #zeroday

    Post summary

    The post announces CVE-2025-8572, explaining that a parameter validation flaw in Truelysell Core up to 1.8.7 permits unauthenticated users to create admin accounts, and provides a link that likely contains further vulnerability details.

    0000048
    131 followersView on X
  • Säkerhetsbloggen@Sakerhetsblogg
    Disclosure

    CVE-2025-8572 i Truelysell Core för WordPress möjliggör privilegierad eskalering via otillräcklig validering av användarrollen. Obegärda användare kan skapa konton med administratörsprivilegier! Uppgradera nu för att skydda din webbplats. #säkerhet #cybersäkerhet #CVE

    Post summary

    The post discloses a privilege escalation flaw (CVE-2025-8572) in Truelysell Core for WordPress and urges users to upgrade to mitigate the issue.

    0000030
    7 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2025-8572 Truelysell Core WordPress Plugin Privilege Escalation via User Role Manipulation https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-8572

    Post summary

    This entry announces CVE-2025-8572, a privilege escalation flaw in the Truelysell Core WordPress Plugin that manipulates user roles; no PoC, exploit, patch, or active exploitation details are provided.

    0000038
    4.0K followersView on X
  • The Hacker Wire@TheHackerWire
    Disclosure

    🔴 CVE-2025-8572 - Critical The Truelysell Core plugin for WordPress is vulnerable to privilege escalation in versions less than, or equal to, 1.8.7. This is due to insufficient validation of the user_role parameter ... https://www.thehackerwire.com/vulnerability/CVE-2025-8572/ https://t.co/aCozEkBEtO

    Post summary

    The text announces a privilege escalation vulnerability (CVE‑2025‑8572) in Truelysell Core WordPress plugin, caused by insufficient validation of the user_role parameter. No PoC, exploit, or patch details are provided.

    0000070
    112 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2025-8572 The Truelysell Core plugin for WordPress is vulnerable to privilege escalation in versions less than, or equal to, 1.8.7. This is due to insufficient validation of the … https://www.cve.org/CVERecord?id=CVE-2025-8572

    Post summary

    The post announces that Truelysell Core WordPress plugin versions up to 1.8.7 are vulnerable to privilege escalation due to insufficient validation.

    00000414
    56.5K followersView on X

Explore more

Back to dashboard