PT-2025-44766 · WordPress · Doccure Core Plugin

Alyudin Nafiie · CVE-2025-8900 · Published 2025-11-03 · Updated 2025-11-08

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Doccure Core plugin for WordPress versions prior to 1.5.4

Description The Doccure Core plugin for WordPress allows privilege escalation in versions prior to 1.5.4. This occurs because the plugin permits users creating new accounts to define their own role, specifically through the user type field. This enables unauthenticated attackers to obtain elevated privileges by registering an account with administrator rights.

Recommendations Update the Doccure Core plugin to version 1.5.4 or later.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-8900

Affected Products

Doccure Core Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-8900 · Security Note
• https://twitter.com/cracbot/status/1986750539112333734 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/49e133c9-5d3b-4a2a-8385-e2db44baa217?source=cve · Note
• https://themeforest.net/item/doccure-medical-wordpress-theme/34329202 · Note
• https://t.me/CVEtracker/36422 · Telegram Post
• https://twitter.com/cracbot/status/1987112925904228718 · Twitter Post