CVE-2025-67915
Published: 08 January 2026
Summary
CVE-2025-67915 is a high-severity Authentication Bypass Using an Alternate Path or Channel (CWE-288) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2025-67915 is an Authentication Bypass Using an Alternate Path or Channel vulnerability (CWE-288) in the Arraytics Timetics WordPress plugin. Published on 2026-01-08, this issue affects all versions of Timetics from n/a through 1.0.46 and enables authentication abuse.
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Low-privileged authenticated users can exploit it remotely with low attack complexity and no user interaction, potentially achieving high impacts on confidentiality, integrity, and availability.
The Patchstack advisory provides further details on this broken authentication vulnerability in Timetics 1.0.46: https://patchstack.com/database/Wordpress/Plugin/timetics/vulnerability/wordpress-timetics-plugin-1-0-46-broken-authentication-vulnerability?_s_id=cve.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1541
Vulnerability details
Authentication Bypass Using an Alternate Path or Channel vulnerability in Arraytics Timetics timetics allows Authentication Abuse.This issue affects Timetics: from n/a through <= 1.0.46.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an authentication bypass in a public-facing WordPress plugin, directly enabling exploitation of a public-facing application for unauthorized access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for all logical access paths, directly preventing authentication bypass via alternate channels in the Timetics plugin.
Explicitly authorizes and limits actions performable without identification or authentication, mitigating unintended bypasses through alternate paths exploited by low-privileged users.
Requires timely identification, reporting, and correction of flaws like this authentication bypass vulnerability via patching the affected Timetics plugin versions.