CVE-2025-8900 is a critical privilege escalation vulnerability (CWE-269) in the Doccure Core plugin for WordPress. Versions prior to 1.5.4 allow unauthenticated attackers to create new user accounts with elevated privileges by specifying the 'user_type' parameter during registration. This improper privilege management flaw enables attackers to gain administrator-level access without authentication, posing a severe risk to affected WordPress sites.

Successful exploitation results in an attacker gaining administrator privileges on the affected WordPress site, allowing full control over the site, including content modification, user management, and potential further compromise of the hosting environment. The CVSS score of 9.8 reflects the critical nature of this vulnerability with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

No official patch or fix is currently confirmed or available for this vulnerability. Users should monitor the vendor's advisory for updates and apply the official update to version 1.5.4 or later once released. Until then, restrict user registration or implement additional access controls to prevent exploitation. Avoid allowing unauthenticated user registrations or sanitize and validate the 'user_type' field if possible.