CVE-2026-39773

CVE-2026-39773 is a critical incorrect privilege assignment flaw (CWE-266) in the WordPress component Doctreat Core, versions 1.7.0 and earlier. It is reachable over the network by an unauthenticated attacker with no user interaction, and the CVSS 3.1 score of 10.0 reflects high impacts to confidentiality, integrity, and availability with a changed scope. Successful exploitation can let an attacker escalate privileges without valid credentials and potentially take over the affected site. WordPress sites running Doctreat Core 1.7.0 or older are affected. It is not in the CISA Known Exploited Vulnerabilities catalog and no public proof-of-concept is known.

What to do: Upgrade Doctreat Core to a version newer than 1.7.0 as soon as the vendor publishes a fix, and confirm the installed version is outside the affected range. Until patched, restrict public access to the WordPress site where practical and review user accounts and roles for unexpected privilege changes.