CVE-2025-6254 is a critical privilege escalation vulnerability in the Doctreat Core plugin for WordPress, affecting all versions up to and including 1.6.8. The issue stems from improper privilege management in the doctreat_process_registration() function, which fails to restrict the roles assigned to newly registered users. As a result, unauthenticated attackers can exploit this flaw to register accounts with administrator privileges, leading to complete compromise of the affected WordPress site. The CVSS 3.1 base score is 9.8, reflecting the high impact on confidentiality, integrity, and availability. No official patch or remediation guidance has been published by the vendor as of the provided data.

Successful exploitation allows unauthenticated attackers to gain administrator-level access to the WordPress site running the vulnerable Doctreat Core plugin. This grants full control over the site, including the ability to modify content, install malicious code, and disrupt service. The vulnerability severely compromises confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict public user registration or disable the Doctreat Core plugin if possible. Monitor for updates from AmentoTech and apply patches promptly once released.