CVE-2025-6254

CriticalCVSS 9.8/10Last modified Oct 7, 2026

Description

The Doctreat Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.6.8. This is due to the doctreat_process_registration() function not properly restricting the roles that a user can register with. This makes it possible for unauthenticated attackers to register as an administrator user.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

VendorProductVersions
AmentoTechDoctreat Core<= 1.6.8

References

Timeline

Published
Jun 10, 2026
Last modified
Oct 7, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-625498.8Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a netCVE-2025-62556.4The Dynamic AJAX Product Filters for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ paramCVE-2025-625508.8Out-of-bounds write in Azure Monitor Agent allows an authorized attacker to execute code over a network.CVE-2025-625527.8Relative path traversal in Microsoft Office Access allows an unauthorized attacker to execute code locally.CVE-2025-625537.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-625547.8Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-625557.0Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-625567.8Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-625577.8Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-625587.8Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-625597.8Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-62566.4The Flex Guten plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘thumbnailHoverEffect’ parameter in all versions up
CVE-2025-6254: Critical severity, CVSS 9.8 | Vulnix