BaseFortify

Executive Summary

The Doccure Core plugin for WordPress has a privilege escalation vulnerability in versions up to, but not including, 1.5.4. This occurs because the plugin allows users registering new accounts to set their own role by supplying the 'user_type' field. As a result, unauthenticated attackers can create accounts with administrator privileges.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow unauthenticated attackers to gain administrator-level access to a WordPress site using the Doccure Core plugin. This elevated privilege can lead to full control over the site, including modifying content, stealing data, installing malicious code, or disrupting site operations.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Doccure Core plugin for WordPress to version 1.5.4 or later, as versions prior to 1.5.4 are vulnerable. Additionally, review and restrict user registration processes to prevent unauthenticated users from assigning themselves elevated roles such as administrator.

Useful 0 Not Useful 0