AmentoTech Doctreat theme: Unrestricted file upload without authentication
Summary
The WordPress theme Doctreat up to and including version 1.7.0 contains an unrestricted file upload flaw (CWE-434). An unauthenticated remote attacker can upload arbitrary files to a vulnerable website without logging in or user interaction. Successful uploads can plausibly lead to code execution and takeover of the server, which is why the CVSS score is 10.0.
Affected
- Doctreat WordPress theme, all versions up to and including 1.7.0
- Doctreat Core (separate plugin) is not covered by this entry
Fixed in
Unknown. No patched theme release has been confirmed by the sources reviewed.
Workaround
- No official mitigation documented.
- Deactivate and remove the theme if it is not required.
- Place a web application firewall in front of the site; no CVE-specific rule was identified.
- Restrict PHP execution in the uploads directory as general hardening.
Exploitation
- CISA KEV: not listed.
- Public proof of concept: none found in the searches performed; absence of results is not proof that none exists.
- Patchstack rates the issue as high priority and expects exploitation; CISA SSVC lists exploitation as none.
- Attack vector: network, no privileges, no user interaction.
Our recommendation
- Inventory all WordPress sites for the Doctreat theme and record exact versions.
- Check the Patchstack page and AmentoTech for a patched release and a vendor statement.
- Deactivate or isolate affected installations that are internet-reachable until a fix is confirmed.
- Review the uploads directories and web server logs for unexpected files and unusual requests.
- Recheck NVD, CISA KEV and Patchstack regularly, as NVD analysis is still pending.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory CVE-2026-39770 patchstack.com
- Strix CVE-2026-39770 www.strix.ai
- Wordfence Doctreat vulnerabilities www.wordfence.com
- HOL Guard CVE-2026-39770 hol.org
- ThemeForest Doctreat listing themeforest.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:37.
Original description (NVD)
Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.