CVE-2026-39770
Unauthenticated arbitrary file upload in Doctreat <= 1.7.0
- CVSS 3.1
- 10.0 critical
- EPSS
- —
- Published
- ·
- Modified
CVE-2026-39770 is an unauthenticated arbitrary file upload flaw (CWE-434) in the Doctreat WordPress theme, versions 1.7.0 and earlier. A remote attacker can upload arbitrary files without logging in and without user interaction, over the network. With CVSS 3.1 10.0 (scope changed and high impact to confidentiality, integrity, and availability), a successful upload can fully compromise the WordPress site, including remote code execution if an executable file is stored where the server will run it. Sites running Doctreat 1.7.0 or older are affected. It is not listed in CISA KEV, and no public proof-of-concept is known.
What to do: Update Doctreat to a release newer than 1.7.0 as soon as the vendor publishes a fix, and until then restrict or disable unauthenticated upload endpoints (for example with a WAF rule) and limit executable file types in the web root. Review the site for unexpected uploaded files, new admin users, or webshells, and rotate WordPress and hosting credentials if any are found.
| Product | Affected |
|---|---|
| Amentotech Doctreat | <= 1.7.0 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions.
- Ecosystems
- WordPress
- Weakness
- CWE-434
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
In the news
0 storiesNo ingested article mentions this CVE yet.