EUVD-2025-210104
GHSA-cx49-m9xj-cc6r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconFingerprint WordPress site running Doctreat
-
DeliveryLocate doctreat registration endpoint
-
ExploitSubmit POST with role=administrator
-
InstallPlugin creates admin account
-
C2Log in via wp-login.php
-
ExecuteUpload webshell or malicious plugin
-
ImpactFull site compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the Doctreat Core plugin (version 1.6.8 or earlier) to be installed and active on a WordPress site with its self-registration endpoint reachable - this is the default deployment because the plugin's purpose is doctor/patient onboarding. No authentication, no user interaction, and no special non-default settings are required: the doctreat_process_registration() handler itself is the entry point. The principal limiting factor is exposure of that specific plugin's registration endpoint; sites that have disabled WordPress registration globally or removed the Doctreat registration page are not exploitable, and sites not running the Doctreat theme/plugin are not affected at all. |
| Impact | All signals point to high real-world risk. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) means a single unauthenticated HTTP request yields full administrative control - the highest impact tier WordPress offers. The vulnerability is reported by Wordfence, a credible WordPress threat-intel source, increasing the likelihood of opportunistic mass scanning against Doctreat installations. EPSS score was not provided in the input and the CVE is not listed in CISA KEV, so widespread active exploitation is not confirmed; however, privilege-escalation-to-admin flaws in commercial WordPress themes historically attract automated exploitation within days of disclosure. SSVC inputs were not supplied, but based on CVSS this would map to automatable=yes and technical impact=total. Net assessment: treat as a priority patch for any site running the Doctreat theme. |
| Exploit ScenarioDerived | An attacker scans for WordPress sites running the Doctreat theme (fingerprintable via theme assets and exposed plugin paths), then sends a single crafted POST to the Doctreat registration endpoint with the role field set to 'administrator'. The new admin account logs in via /wp-login.php, installs a malicious plugin or edits theme PHP for a webshell, and proceeds to data exfiltration, defacement, or SEO-spam injection. No public PoC is referenced in the provided data, but the exploit is trivial to reconstruct from the description. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 10, 2026
Unauthenticated privilege escalation in the Doctreat Core WordPress plugin (versions ≤ 1.6.8) allows remote attackers to register accounts directly as administrators by abusing insufficient role validation in the doctreat_process_registration() function. With a CVSS of 9.8 and trivial exploitability (AV:N/AC:L/PR:N/UI:N), full site takeover is possible without credentials, though no public exploit has been identified at time of analysis and the CVE is not currently listed in CISA KEV.
RemediationAI
No vendor-released patched version is identified in the available data - references point only to the Wordfence threat-intel entry and the ThemeForest product page, with no fixed version cited. Site operators should immediately check ThemeForest for an updated Doctreat theme/plugin release above 1.6.8 and apply it as soon as published, and in the meantime disable user self-registration by unchecking 'Anyone can register' in Settings > General (side effect: legitimate doctor/patient self-onboarding will break and must be handled manually or via a vetted alternative form), deactivate the Doctreat Core plugin if registration is not business-critical (side effect: theme features that depend on it will stop working), or place a WAF/virtual-patching rule (e.g., Wordfence) in front of the registration endpoint to block requests containing a role parameter set to administrator. After remediation, audit wp_users for unexpected administrator accounts created since plugin installation and force a password reset on all admins.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Doctreat Core plugin underpins the commercial Doctreat doctors-directory WordPress theme sold on ThemeForest (item 24867777) by Amentotech. WordPress exposes a register_user / wp_insert_user role parameter that must be server-side enforced because client-supplied role values are untrusted. CWE-269 (Improper Privilege Management) applies here: the doctreat_process_registration() handler accepts the desired role from the registration request without restricting it to the intended low-privilege values (e.g., subscriber, doctor, patient), allowing 'administrator' to be passed through to user creation. The affected CPE is cpe:2.3:a:amentotech:doctreat_core:*:*:*:*:*:*:*:* covering all versions through 1.6.8.
Know when Doctreat Core gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Doctreat Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.6.8. This is due to the doctreat_process_registration() function not properly restricting the roles that a user can register with. This makes it possible for unauthenticated attackers to register as an administrator user.
Articles & Coverage 2
Executive ViewAI
The Doctreat Core WordPress plugin (versions ≤1.6.8) contains a critical flaw enabling unauthenticated attackers to register as administrators and gain full control of affected websites without requiring any legitimate credentials. While no public exploit has been identified at time of analysis, the vulnerability's trivial technical complexity and broad WordPress adoption mean active exploitation could materialize rapidly. Organizations running this plugin face immediate risk of complete site compromise, including data theft, malware injection, and operational disruption.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable Doctreat Core plugin immediately; (2) Implement Web Application Firewall rules to block registration endpoints; (3) Restrict WordPress user registration to trusted IP ranges; (4) Enable mandatory two-factor authentication for all administrator accounts; (5) Deploy real-time user account creation alerting and daily account audits. Monitor vendor communications closely for patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB