CVE-2025-6254: Critical Privilege Escalation in Doctreat Core WordPress Plugin

Technical summary

CVE-2025-6254 is a privilege escalation vulnerability in the Doctreat Core plugin affecting versions 1.6.8 and earlier. The vulnerability exists in the doctreat_process_registration() function, which processes user registration requests but does not properly restrict or validate the user role parameter. An unauthenticated attacker can craft a registration request specifying the 'administrator' role, and the function will create the account with those privileges. The vulnerability maps to CWE-269 (Improper Access Control), allowing direct assumption of administrative capabilities without prior authentication or authorization checks.

Business impact

This vulnerability poses an immediate and severe threat to any WordPress site running the affected Doctreat Core plugin. An attacker can register as an administrator within minutes of discovering a vulnerable installation, then modify site content, install malicious plugins, access sensitive data, create persistent backdoors, or completely deface the site. Organizations relying on this plugin for user management face potential data breaches, regulatory compliance violations, and operational disruption. The ease of exploitation and lack of authentication requirements mean that automated scanning and mass exploitation are likely.

Affected systems

Doctreat Core plugin for WordPress, all versions up to and including 1.6.8. The vulnerability affects any WordPress installation with this plugin active, regardless of site size, hosting provider, or configuration. No specific WordPress core version requirements have been identified that would limit exposure.

Exploitability

This vulnerability is trivial to exploit. An attacker requires no prior access, no credentials, and no user interaction from victims. The attack is entirely network-based with no complexity. An attacker can perform the privilege escalation in a single HTTP request to the plugin's registration endpoint, specifying administrator role parameters. The lack of CAPTCHA, rate limiting, or role validation in the vulnerable function means automated exploitation at scale is feasible. Given the CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N, this represents a weaponizable flaw.

Remediation

Immediately update the Doctreat Core plugin to a version after 1.6.8. Verify against the vendor's official advisory for the patched version number. If an immediate patch is unavailable, consider disabling the plugin entirely until a fixed version is released. For sites that cannot update immediately, restrict access to the plugin's registration endpoint using Web Application Firewall (WAF) rules or server-level authentication. Review user accounts created during the potential exposure window for unauthorized administrator accounts and audit their activity logs.

Patch guidance

Check the Doctreat Core plugin repository or vendor advisory for the first available version after 1.6.8 that addresses this issue. Apply the patch through the WordPress admin dashboard (Plugins > Installed Plugins > Update) or manually via SFTP/file manager. Test the update in a staging environment first to ensure compatibility with other plugins and custom themes. After patching, audit the wp_users table for unexpected administrator accounts created during the vulnerability window, and review administrator access logs for suspicious activity.

Detection guidance

Monitor WordPress user registration logs and wp_users table additions for new administrator accounts created without corresponding administrative action in audit logs. In WAF or server logs, look for POST requests to registration endpoints specifying administrator role parameters. Check for rapid account creation patterns suggesting automated exploitation attempts. Review the access logs for the plugin's registration functions (typically /wp-admin/admin-ajax.php with doctreat_process_registration action) for unusual traffic spikes or geographically anomalous sources. Ensure WordPress user creation audit logging is enabled and monitored continuously.

Why prioritize this

This vulnerability merits immediate attention due to its CRITICAL severity (CVSS 9.8), complete lack of authentication requirements (PR:N), and direct path to full site compromise. Unlike vulnerabilities requiring user interaction or special access, this flaw allows complete administrative takeover in seconds. Organizations running Doctreat Core should treat this as an emergency requiring immediate patching or plugin disabling. The ease of exploitation means that delayed response significantly increases the likelihood of active compromise.

Risk score, explained

The CVSS 3.1 score of 9.8 reflects the confluence of maximum exploitability factors: network-accessible endpoint (AV:N), no authentication required (PR:N), no user interaction needed (UI:N), and unrestricted scope (S:U). The impact is total across all three security properties—an attacker gains full confidentiality, integrity, and availability compromise (C:H/I:H/A:H). The only factor preventing a perfect 10.0 score is the requirement for the plugin to be actively installed, which is a deployment factor rather than a flaw in the vulnerability itself.

Frequently asked questions