CVE-2025-9114 is an authorization bypass vulnerability in the Doccure WordPress theme (versions ≤ 1.5.0) by dreamstechnologies. The vulnerability arises because the plugin allows user-controlled access to objects, enabling attackers to bypass authorization checks and change arbitrary user passwords without authentication. This can lead to complete compromise of administrator accounts. The vulnerability is rated critical with a CVSS score of 9.8, reflecting its ease of exploitation and severe impact on confidentiality, integrity, and availability. No patch or official fix has been published yet, and the product is not a cloud service, so remediation depends on vendor updates or user action.

Successful exploitation allows unauthenticated attackers to change any user’s password, including administrators, resulting in potential full system compromise. This impacts confidentiality, integrity, and availability of the affected WordPress site. The vulnerability can lead to unauthorized access and control over the site’s resources.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected plugin, disabling it if possible, or applying temporary access controls to limit exposure. Monitor official channels from dreamstechnologies for updates and apply patches promptly once available.