External risk intelligence

Doccure Core WordPress Plugin Privilege Escalation

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-8900

The vulnerability exists in a WordPress plugin that handles user registration. WordPress registration pages are public-facing by design to allow new users to sign up, making this interface directly accessible over the internet in standard deployments.

Privilege Escalation

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects the Doccure Core plugin for WordPress, which is used for managing medical-related websites. It allows unauthenticated individuals to gain administrative privileges by exploiting the user registration process, potentially leading to unauthorized control over the entire website.

Unauthenticated attackers can take over WordPress admin.
It enables unauthorized website control via user registration.
Confirm if this plugin is used and update it.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit this vulnerability by creating a new user account on a vulnerable WordPress site. During registration, the attacker could manipulate a specific field to assign themselves an administrator role, bypassing normal permission checks. This would grant them full control over the website.

No authentication required to initiate.
User registration process is the trigger.
Gain administrator privileges on the site.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to register for an administrator account on a WordPress site using the Doccure Core plugin. This may occur when the plugin's user registration functionality is enabled, potentially exposing administrative control of the website.

Website administrative control.
Unauthenticated user registration.
Full site compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

To address this privilege escalation vulnerability in the Doccure Core WordPress plugin, the platform or web administration teams are likely responsible for initial triage and remediation. The first practical step is to identify all WordPress instances using this plugin, confirm their online exposure and business criticality, and then coordinate with the accountable application or site owner to plan remediation, prioritizing instances that are publicly accessible and critical to operations.

Platform/Admin teams own the issue.
Verify plugin usage and exposure.
Plan coordinated remediation by owner.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Doccure Core plugin for WordPress?

Doccure Core is a specialized plugin for WordPress designed to help manage and operate medical-related websites. It typically provides the backend functionality necessary to organize clinical information, patient appointments, or medical service data within the WordPress environment.

What does CWE-269 mean for CVE-2025-8900?

CWE-269 refers to Improper Privilege Management. In the context of this vulnerability, it means the plugin fails to properly verify or restrict a user's role during registration. Instead of assigning a standard, low-level account, the software mistakenly allows an attacker to assign themselves administrative powers.

How does an attacker trigger this privilege escalation?

An attacker triggers this by interacting with the plugin's registration form during the account creation process. They do not need existing credentials to do this. Simply submitting a specific request that includes an elevated 'user_type' field is enough to trick the plugin, provided the registration functionality itself is enabled on the site.

Why is this a high priority for internet-facing sites?

Halo Surface Signal indicates that because this plugin handles user registration, which is often a public-facing feature, the entry point for this attack is directly reachable over the internet. Sites that allow open registration are at the highest risk, as the vulnerability does not require the attacker to have any prior access to the network or internal systems.

Is there a first step to secure my site?

Yes. Immediately verify whether your WordPress instance is running the Doccure Core plugin. If you identify it, coordinate with your site owners to confirm your current version. Since this issue is resolved in version 1.5.4, your primary goal is to move to that version or higher to effectively close the registration loophole.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.