Truelysell Core WordPress Plugin Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in the Truelysell Core plugin for WordPress, affecting versions through 1.8.7. The issue arises from inadequate validation of the user_role parameter during user registration, allowing unauthenticated attackers to create accounts with elevated privileges, including administrative rights.

Impact

Exploitation of this vulnerability allows unauthenticated users to gain administrative privileges on the WordPress site.

Remediation

Users are advised to update the Truelysell Core plugin to version 1.8.8 or a newer patched version.