Doctreat Core plugin: Privilege escalation to administrator
Summary
The WordPress plugin Doctreat Core in versions up to and including 1.7.0 contains a privilege escalation flaw (CWE-266). An unauthenticated remote attacker can potentially gain administrator rights on the WordPress site. A successful attack could lead to full control over the website and its data.
Affected
- Doctreat Core (WordPress plugin) versions up to and including 1.7.0
- Versions above 1.7.0: not listed as affected in the sources reviewed
Fixed in
Unknown. No fixed version or vendor advisory was found.
Workaround
- No vendor mitigation was found.
- Patchstack reports a mitigation rule that blocks attacks until an official patch is available (Patchstack customers only).
- Disabling the plugin until a fixed version is confirmed is the only generic measure available.
Exploitation
- Known exploited (KEV): no.
- Public proof of concept: none found for this CVE.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- Patchstack expects exploitation and notes that no login is needed.
Our recommendation
- Identify all WordPress sites with Doctreat Core installed, including the version.
- Disable the plugin on sites where it is not business-critical, and isolate other sites until a fixed version is confirmed.
- Review user accounts for unexpected administrators and check for signs of compromise.
- Monitor the vendor, Patchstack and NVD for an update and apply it as soon as it is available.
- Treat this as critical, especially for medical or clinic sites holding patient or booking data.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack vulnerability entry CVE-2026-39773 patchstack.com
- HOL Guard CVE-2026-39773 hol.org
- Strix CVE-2026-39773 www.strix.ai
- OpenCVE Doctreat Core product app.opencve.io
- Patchstack researcher page patchstack.com
- WPScan Doctreat Core plugin wpscan.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:38.
Original description (NVD)
Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.