CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Truelysell Core plugin for WordPress is vulnerable to privilege escalation in versions less than, or equal to, 1.8.7. This is due to insufficient validation of the user_role parameter during user registration. This makes it possible for unauthenticated attackers to create accounts with elevated privileges, including administrator access.
Explanation of Vulnerability in Simple Terms
Truelysell Core versions up to 1.8.7 contain a privilege management flaw that allows unauthenticated attackers to gain full control over the application. The vulnerability requires no user interaction and can be exploited remotely over the network. An attacker can read sensitive data, modify site content, and disrupt service availability.
What an attacker can do
Read sensitive data, modify content, and disable the site without needing to log in.
Potential impact on your site
Complete compromise of the site and all user data; attacker gains administrative control.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
