The Hospital Doctor Directory plugin from e-plugins contains an incorrect privilege assignment flaw that allows an attacker to elevate their permissions within the WordPress site. The vulnerability is classified as CWE‑266, indicating a weakness in controlling team or user access rights. An attacker who can trigger the flaw would gain elevated privileges, potentially allowing full administrative control over the WordPress installation.

This issue affects the e‑plugins Hospital Doctor Directory plugin for all versions from the earliest revision through 1.3.9. The vulnerability is present in any WordPress site that has not upgraded beyond 1.3.9, regardless of custom configuration or theme.

The CVSS score of 8.8 highlights a high severity risk, while the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, which further indicates limited exploitation activity. Based on the description, the likely attack path involves authenticating to the WordPress admin area and exploiting the plugin’s privilege assignment logic, though the exact prerequisites are not detailed in the report.