Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Doctreat Core plugin lets anyone gain admin rights

CVE-2026-39773 · published 12 days ago
Summary

The Doctreat Core plugin for WordPress (versions up to 1.7.0) can be accessed without a login and used to give a user full administrative control. This means an attacker could change settings, view or edit data, and install other code. Update the plugin to a newer version or remove it if it is not needed to protect your site.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
amentotech doctreat core <= 1.7.0
Original advisory text
WordPress Doctreat Core plugin <= 1.7.0 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
10.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-266Incorrect Privilege Assignment
Timeline
Published6 Oct 2026
Updated15 Oct 2026
First seen6 Oct 2026
Sources
CVE-2026-39773 · NVD
CVE-2026-39773 · MITRE
Track software like this
Free during beta