Quick answers
- Is CVE-2026-39773 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-39773 being exploited in the wild.
- How severe is CVE-2026-39773?
- Critical severity, with a CVSS score of 10, published 6 October 2026.
- Which products and versions are affected?
- Doctreat Core <= 1.7.0.
- Is there a fix for CVE-2026-39773?
- No fixed version is recorded yet. Until an official patch is released, use Patchstack or similar WordPress security solutions to apply WAF-level mitigation rules that block attacks targeting this vulnerability. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-39773 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-39773?
- Check whether you run Doctreat Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Until an official patch is released, use Patchstack or similar WordPress security solutions to apply WAF-level mitigation rules that block attacks targeting this vulnerability.
Technical details
A privilege escalation vulnerability in Doctreat Core versions 1.7.0 and earlier allows an unauthenticated attacker to become an administrator. The vulnerability exists in the plugin's authentication or authorization mechanism, enabling unauthorized access to administrative functions. No official patch is currently available.
Affected products
- Doctreat Doctreat Core <= 1.7.0
Timeline
- 2026-10-06: disclosed
- 2026-10-05: advisory