Summary
CVE-2025-6254 is a critical unauthenticated privilege escalation vulnerability in the Doctreat Core plugin for WordPress (by AmentoTech), a companion plugin for the Doctreat healthcare and doctors-directory theme. The flaw allows any unauthenticated remote attacker to self-register as a WordPress administrator, resulting in complete site takeover. All versions up to and including 1.6.8 are affected, with a CVSS v3.1 base score of 9.8 (Critical).
Technical details
- Root cause: The
doctreat_process_registration()function does not validate or restrict the user role submitted during registration. An attacker can supply an arbitrary role value — includingadministrator— and the plugin will assign that role to the newly created account without any server-side authorization check. This is classified as CWE-269 (Improper Privilege Management). - Trigger conditions: No authentication, account, or prior access of any kind is required. The attack is triggered by submitting a crafted registration request to the plugin’s registration endpoint with an elevated role value.
- Attack vector: Fully remote, over the network (AV:N). The attack requires no user interaction, no privileges, and has low complexity (AC:L/PR:N/UI:N).
- Impact: Successful exploitation grants the attacker a fully privileged WordPress administrator account, enabling complete control over the site — including arbitrary file upload, plugin/theme installation, data exfiltration, defacement, and use as a staging point for further attacks against the hosting environment. Confidentiality, integrity, and availability are all fully compromised (C:H/I:H/A:H).
Affected software
- Doctreat Core (WordPress plugin by AmentoTech) — all versions up to and including 1.6.8
Severity
- CVSS v3.1 Base Score: 9.8 (Critical)
- Vector String:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate — Update to version 1.7.0: AmentoTech has released Doctreat Core version 1.7.0, which addresses this vulnerability. All sites running the Doctreat theme with the Doctreat Core companion plugin should update immediately.
- If immediate patching is not possible: Disable the Doctreat Core plugin until the update can be applied. Additionally, restrict access to the WordPress registration endpoint (
/wp-login.php?action=register) at the network or WAF level to reduce exposure while remediation is pending. - Review all existing WordPress user accounts for unexpected administrator-level accounts that may have been created prior to patching, and revoke any unauthorized accounts found.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

