The Doctreat Core plugin for WordPress contains a flaw in the doctreat_process_registration() function that fails to enforce role restrictions. This flaw lets anyone visit the registration endpoint and create an account with the administrator role without providing credentials. The result is that an unauthenticated attacker can gain full administrative control of the WordPress site, including installing plugins, changing settings, and accessing sensitive data.

The vulnerability affects the AmentoTech Doctreat Core plugin, versions 1.6.8 and earlier. Any WordPress installation that includes this plugin and has user registration enabled is susceptible.

The CVSS score of 9.8 indicates Critical severity, and while the EPSS score is not reported, the high impact and lack of authentication requirement suggest a realistic exploitation window. The vulnerability is not in the CISA KEV catalog, but given its broad impact, it warrants immediate attention. Attackers can exploit the flaw by sending a standard registration request to the plugin’s endpoint; no special preconditions are required beyond access to the site’s public registration page.