CVE-2025-23528
Published: 16 January 2025
Summary
CVE-2025-23528 is a high-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 35.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-23528 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the DD Roles WordPress plugin developed by Mosterd3d. The flaw allows for privilege escalation and affects all versions of the dd-roles plugin from n/a through 4.1 inclusive.
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). It can be exploited over the network by an authenticated attacker with low privileges, requiring low complexity and no user interaction. Successful exploitation grants high impacts on confidentiality, integrity, and availability, enabling privilege escalation within the affected WordPress installation.
Patchstack advisories document this privilege escalation vulnerability in the DD Roles plugin up to version 4.1, providing details on the issue at https://patchstack.com/database/Wordpress/Plugin/dd-roles/vulnerability/wordpress-dd-roles-plugin-4-1-privilege-escalation-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3229
Vulnerability details
Incorrect Privilege Assignment vulnerability in Mosterd3d DD Roles dd-roles allows Privilege Escalation.This issue affects DD Roles: from n/a through <= 4.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes an incorrect privilege assignment vulnerability in a WordPress plugin that directly enables privilege escalation by an authenticated low-privilege attacker, mapping to T1068: Exploitation for Privilege Escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely identification, reporting, and correction of the privilege escalation flaw in DD Roles plugin versions through 4.1.
Enforces least privilege assignment to counter incorrect privilege assignment enabling low-privilege users to escalate in the DD Roles plugin.
Manages account privileges to ensure proper assignment and review, mitigating exploitation of the DD Roles plugin's privilege escalation vulnerability.