Introduction
A critical flaw in the Doccure Core plugin lets attackers take full administrative control of healthcare and telemedicine WordPress sites. Unauthenticated users can create administrator accounts by manipulating the registration process, which puts sensitive patient data at risk of exposure and medical services at risk of disruption.
About Doccure and Dreams Technologies: Doccure is a healthcare management and telemedicine platform from Dreams Technologies, used by hospitals, clinics, and practitioners worldwide. Its WordPress plugin and theme are a popular way to add appointment scheduling and patient management to healthcare websites. Dreams Technologies has a history of security issues in the Doccure product line, including password reset and file upload vulnerabilities.
Technical Information
CVE-2025-8900 affects Doccure Core plugin versions up to and excluding 1.5.4. The flaw is in how the plugin handles user registration. The registration process accepts a 'user_type' parameter from the client and uses it to assign the account's WordPress role, and the plugin does not validate or restrict that parameter server-side. An attacker can therefore submit a registration request with 'user_type' set to 'administrator' and receive an account with full admin privileges.
The flaw is classified as CWE-269 (Improper Privilege Management). It bypasses WordPress's default behavior of giving new users a safe default role (usually 'subscriber'). The attacker needs only access to the public registration endpoint and the ability to modify HTTP requests. No authentication or prior access is needed.
Detection Methods
Detecting unauthenticated privilege escalation vulnerabilities, such as those in the Doccure Core plugin for WordPress, takes a combination of static and dynamic analysis. (help.sap.com)
Static Analysis: Review the plugin's source code for improper access controls or authentication mechanisms that could allow unauthorized privilege escalation. Check the plugin's configuration files and settings to confirm that default credentials are not in use and that permissions are set appropriately.
Dynamic Analysis: Penetration testing in a controlled environment simulates attacks against known vulnerabilities to show how well the plugin resists unauthorized access attempts. Runtime monitoring tools can catch anomalies in the plugin's behavior, such as unexpected changes to user roles or permissions.
Indicators of Compromise (IoCs): Watch for user roles that change without proper authorization, which may indicate exploitation. Also watch for administrative actions performed by accounts that do not normally hold those privileges.
Monitoring Guidance: Review server and application logs regularly for signs of unauthorized access or privilege escalation attempts. Set up alerts for specific events, such as changes to user roles or the creation of new administrative accounts, so you can detect and respond to potential threats quickly.
Affected Systems and Versions
- Product: Doccure Core WordPress plugin
- Affected versions: All versions up to and excluding 1.5.4 (that is, 1.5.3 and earlier)
- Vulnerable configuration: Any WordPress site that has public registration enabled and runs a vulnerable version of the Doccure Core plugin
Vendor Security History
Dreams Technologies, the vendor behind Doccure, has previously released products with similar privilege management flaws, including:
- CVE-2025-9112: Unauthenticated arbitrary user password change in Doccure theme
- Arbitrary file upload vulnerabilities in Doccure products
These issues indicate recurring gaps in secure development practices and code review across the vendor's product line.
