Privilege Escalation Vulnerability in Doccure Core Plugin for WordPress

CVE-2025-8900

What is CVE-2025-8900?

The Doccure Core plugin for WordPress has a security flaw that allows unauthenticated attackers to escalate their privileges. This occurs when the plugin permits users registering new accounts to define their own roles, a feature vulnerable to manipulation. By incorrectly specifying the 'user_type' field, attackers can create accounts with elevated permissions, including that of an administrator, potentially compromising the entire WordPress site.

References