Cyber Posture

CVE-2025-29004

High

Published: 06 January 2026

Published
06 January 2026
Modified
23 April 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0008 22.5th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-29004 is a high-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 22.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and AC-3 (Access Enforcement).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Enforces the principle of least privilege, directly mitigating privilege escalation from low-privilege roles like subscriber or contributor exploited in this WordPress plugin vulnerability.

prevent

Mandates enforcement of approved access authorizations, countering the plugin's failure to properly validate and restrict privilege escalations.

preventdetect

Establishes account management processes including privilege reviews, preventing incorrect assignments and enabling detection of anomalous escalations in the vulnerable plugin.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Directly enables authenticated privilege escalation from low-privileged WordPress roles to admin via incorrect privilege assignment in the plugin.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Incorrect Privilege Assignment vulnerability in AA-Team Responsive Coming Soon Landing Page / Holding Page for WordPress wordpress-flat-countdown allows Privilege Escalation.This issue affects Responsive Coming Soon Landing Page / Holding Page for WordPress: from n/a through <= 3.0.

Deeper analysisAI

CVE-2025-29004 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the WordPress plugin Responsive Coming Soon Landing Page / Holding Page for WordPress (wordpress-flat-countdown) developed by AA-Team. It enables privilege escalation and affects all versions from n/a through 3.0. The vulnerability received a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact across confidentiality, integrity, and availability.

An attacker with low-privilege access, such as a subscriber or contributor role on a vulnerable WordPress site, can exploit this issue remotely over the network with low complexity and no user interaction required. Successful exploitation allows the attacker to escalate privileges, potentially gaining administrative control over the site, which could lead to full compromise including data theft, modification of site content, or deployment of further malware.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wordpress-flat-countdown/vulnerability/wordpress-responsive-coming-soon-landing-page-holding-page-for-wordpress-3-0-privilege-escalation-vulnerability?_s_id=cve provides details on this vulnerability, including recommended mitigations such as updating to a patched version if available or applying virtual patching through services like Patchstack. Security practitioners should verify the plugin's update status and restrict low-privilege user capabilities where possible.

Details

CWE(s)

CVEs Like This One

CVE-2026-27102Shared CWE-266
CVE-2025-69293Shared CWE-266
CVE-2026-25414Shared CWE-266
CVE-2025-31643Shared CWE-266
CVE-2025-33179Shared CWE-266
CVE-2026-27541Shared CWE-266
CVE-2025-69378Shared CWE-266
CVE-2025-24648Shared CWE-266
CVE-2025-1653Shared CWE-266
CVE-2025-23528Shared CWE-266

References