Critical severity9.8NVD Advisory· Published Jun 10, 2026· Updated Jun 10, 2026
CVE-2025-6254
CVE-2025-6254
Description
The Doctreat Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.6.8. This is due to the doctreat_process_registration() function not properly restricting the roles that a user can register with. This makes it possible for unauthenticated attackers to register as an administrator user.
Affected products
2<=1.6.8+ 1 more
- (no CPE)range: <=1.6.8
- (no CPE)range: <=1.6.8
Patches
Vulnerability mechanics
References
2News mentions
1- Wordfence Intelligence Weekly WordPress Vulnerability Report (June 8, 2026 to June 14, 2026)Wordfence Blog · Jun 18, 2026