The vulnerability lies in the user registration process of the Doccure Core plugin for WordPress. The plugin accepts a 'user_type' parameter that allows a new account creator to specify the role of the newly registered user. Because this input is not authenticated or validated, an attacker can submit a registration request that assigns the administrator role, thereby creating an account with full site privileges. This results in unauthenticated privilege escalation and gives the attacker complete control over the WordPress installation.

The flaw affects Dream Technologies’ Doccure Core plugin for WordPress on all installations running any version earlier than 1.5.4. The affected code resides in the plugin’s registration handler, which is active on every site that enables user sign‑ups through Doccure Core.

The vulnerability scores a CVSS of 9.8, indicating a critical threat. EPSS is reported as less than 1%, so widespread exploitation has not yet been observed, and it does not appear in the CISA KEV list. Based on the description, it is inferred that the registration endpoint is publicly accessible and accepts the user_type parameter from unauthenticated requests, allowing an attacker to send a crafted POST request. Attackers need only to include a 'user_type' of administrator; no prior compromise or authentication is required.