EUVD-2026-93023
GHSA-r79f-2598-j89j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WordPress site over network
-
DeliverySend crafted request to Doctreat Core endpoint
-
ExploitAbuse incorrect privilege assignment
-
ExecutionObtain administrator-level account
-
ImpactFull site/server compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
| Exploitation Conditions | The only stated prerequisite is a WordPress site running the Doctreat Core plugin at version 1.7.0 or earlier; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation is remote, unauthenticated, requires no user interaction, and works against default configurations. The practical limiting factor is purely population-based: exploitation is confined to sites that have this specific Amentotech plugin installed and un-updated. No authentication, special feature toggle, or non-default setting is documented as required, though the exact vulnerable endpoint/feature is not detailed in the provided data. |
| Impact | The input assigns a maximal CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating a network-reachable, low-complexity, unauthenticated flaw with a scope change and total compromise of confidentiality, integrity, and availability - consistent with CWE-266 (Incorrect Privilege Assignment) in a WordPress plugin, where such bugs typically let an unauthenticated visitor gain administrator-level rights. However, the real-world risk signals are incomplete: no EPSS exploitation-probability score, no CISA KEV listing, and no proof-of-concept were provided, so there is no evidence of active or imminent exploitation at this time. The practical priority is therefore high on paper (trivially exploitable full takeover of any site running the vulnerable plugin) but should be tempered by the product's limited deployment footprint and the absence of any exploitation telemetry. Treat this as a patch-urgently item for the specific population of Doctreat sites, while recognizing that EPSS/KEV/POC data is missing rather than confirmed-low - absence of exploitation data is not the same as confirmed low exploitation. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request to a vulnerable endpoint of the Doctreat Core plugin (<= 1.7.0) on a WordPress site, abusing improper privilege assignment to register or elevate an account to administrator. With admin rights the attacker installs a malicious plugin or web shell, achieving full site takeover. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Unauthenticated privilege escalation in the Doctreat Core WordPress plugin (versions 1.7.0 and earlier, vendor namespace amentotech) lets a remote visitor gain administrator-level rights on any affected site without logging in, supplying credentials, or interacting with a victim. The input assigns a maximal CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting a low-complexity, unauthenticated, network-reachable flaw with scope change and full loss of confidentiality, integrity, and availability; only sites with this specific plugin installed and un-updated are in scope. No public exploit identified at time of analysis, and no CISA KEV listing is present in the provided data.
RemediationAI
No vendor-released patch identified at time of analysis: the provided references contain only the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/doctreat_core/vulnerability/wordpress-doctreat-core-plugin-1-7-0-privilege-escalation-vulnerability?_s_id=cve) and no fixed version number, so treat 1.7.0 as the last known vulnerable release and apply an updated build as soon as Amentotech publishes one. Until then, the most effective compensating control is to deactivate and, if feasible, remove the Doctreat Core plugin from any WordPress site that does not depend on it - the trade-off is loss of whatever front-end functionality the plugin provides. If the plugin is business-critical, restrict reachability of the plugin's request handlers (block its endpoints at the WAF/reverse proxy and deny direct access to its PHP files in wp-content/plugins/), accepting that this may degrade legitimate plugin features, and ensure the site has only one administrator account with strong, unique credentials plus two-factor authentication so an escalation attempt is easier to detect. Because the exploit is unauthenticated, also audit wp_users and wp_usermeta for recently added administrator accounts or unexpected role changes, enable audit logging of user-creation and role-change events, and monitor for outbound callbacks or injected content that would indicate post-exploitation activity; these monitoring steps detect but do not prevent exploitation and add operational overhead.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-266 (Incorrect Privilege Assignment) and lives in Doctreat Core, a WordPress plugin published by Amentotech and tracked as cpe:2.3:a:amentotech:doctreat_core:*:*:*:*:*:*:*:*. In the WordPress execution model, plugins run with full server-side trust and can call core APIs such as wp_set_current_user, wp_update_user, or direct role/capability assignment; a CWE-266 defect means the plugin hands out a privilege level (typically the administrator role or an equivalent capability set) to a caller it should not trust. The CVSS vector's scope change (S:C) and PR:N/UI:N components indicate the vulnerable code path is reachable by an unauthenticated HTTP request against a default configuration, and that the resulting compromise escapes the plugin's own security boundary to affect the whole WordPress installation - consistent with an unauthenticated visitor being escalated to site administrator. The exact vulnerable endpoint, action name, or feature is not enumerated in the provided data, so the underlying request shape cannot be reconstructed from these sources alone.
Know when Doctreat Core gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated network privilege escalation (PR:N, AV:N, AC:L) yielding administrator rights that break the WordPress authorization boundary (S:C) and fully compromise the site (C/I/A:H).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.
Executive ViewAI
The Doctreat Core WordPress plugin from vendor amentotech, versions 1.7.0 and earlier, creates a critical exposure for organizations hosting affected WordPress sites because an unauthenticated remote actor could obtain administrator control without credentials. Leadership should treat any site running this plugin as potentially fully compromised, with complete loss of confidentiality, integrity, and availability across the site. No public exploit identified at time of analysis and no vendor-released patch identified at time of analysis make inventory, isolation, and compensating controls the immediate priority.
No vendor-released patch identified at time of analysis. Deactivate and remove Doctreat Core plugin versions 1.7.0 and earlier where possible; if removal is not feasible, isolate affected WordPress instances, restrict access to wp-admin and login endpoints by IP or VPN, deploy WAF virtual patching for the plugin, enforce MFA and least privilege for administrators, monitor for unauthorized administrator account creation and file changes, and rotate credentials and salts. Apply vendor patch when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB