WordPress Doctreat Plugin Allows Unauthenticated Admin Registration

The Doctreat Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.6.8. This is due to the doctreat_process_registration() function not properly restricting the roles that a user can register with. This makes it possible for unauthenticated attackers to register as an administrator user.

Casky was already ahead

This CVE exploits attack patterns that Casky's 203matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Doctreat Core plugin for WordPress contains a critical privilege escalation vulnerability in its user registration function that fails to validate role assignments. Unauthenticated attackers can exploit the doctreat_process_registration() function to bypass role restrictions and register new accounts with administrator privileges—the highest level of access in WordPress. This vulnerability affects all versions through 1.6.8 and has a CVSS score of 9.8, making it critical for any WordPress installation using this plugin. Organizations relying on Doctreat Core for content management face immediate risk of complete site compromise, data theft, and malicious content injection.

Casky's 203 mapped skills detect this attack pattern through MITRE ATT&CK technique TA0004 (Privilege Escalation) by analyzing registration function behaviors, role assignment logic, and authentication bypass indicators. Practitioners using Casky would observe findings related to improper input validation in user creation workflows, missing authorization checks before privilege assignment, and anomalous account creation patterns showing new administrative users registered from external sources. Claude's extended reasoning capabilities help security teams understand the attack chain: an attacker sends crafted registration requests that manipulate role parameters, the vulnerable function fails to enforce role restrictions, and administrator access is granted without authentication. This structured intelligence enables rapid remediation through plugin updates and detection of compromised accounts created through this vector.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

203 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2025-6254.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-kubernetes-audit-logs

container security · low

Run

analyzing-office365-audit-logs-for-compromise

cloud security · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2025-6254

Casky has 203 skills that investigate the attack patterns behind CVE-2025-6254. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn