Cyber Resilience

CVE-2025-67953

High

Published: 22 January 2026

Published
22 January 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0034 25.5th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-67953 is a high-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 25.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-67953 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the Booking Activities WordPress plugin developed by the Booking Activities Team. This flaw allows for privilege escalation and affects all versions of the plugin from its initial release through version 1.16.44.

The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it can be exploited remotely over the network by unauthenticated attackers without requiring user interaction, though it demands high attack complexity. Successful exploitation enables attackers to achieve high-impact effects on confidentiality, integrity, and availability, specifically through unauthorized privilege escalation within affected WordPress installations.

Patchstack has published details on this vulnerability, including mitigation guidance, available at https://patchstack.com/database/Wordpress/Plugin/booking-activities/vulnerability/wordpress-booking-activities-plugin-1-16-44-privilege-escalation-vulnerability?_s_id=cve. Security practitioners should consult this advisory for patch information and remediation steps.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability details

Incorrect Privilege Assignment vulnerability in Booking Activities Team Booking Activities booking-activities allows Privilege Escalation.This issue affects Booking Activities: from n/a through <= 1.16.44.

CWE(s)
CWE-266

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Direct privilege escalation via unauthenticated remote exploitation of a public-facing WordPress plugin.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-27983Shared CWE-266
CVE-2024-13421Shared CWE-266
CVE-2026-24971Shared CWE-266
CVE-2024-51888Shared CWE-266
CVE-2026-32488Shared CWE-266
CVE-2026-24968Shared CWE-266
CVE-2026-24373Shared CWE-266
CVE-2025-68027Shared CWE-266
CVE-2025-49388Shared CWE-266
CVE-2026-23550Shared CWE-266

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Requires timely identification, reporting, and correction of flaws like this privilege escalation vulnerability in the Booking Activities WordPress plugin.

AC-6 Least Privilege good match
prevent

Enforces the principle of least privilege, directly countering incorrect privilege assignment that enables unauthenticated escalation.

AC-3 Access Enforcement partial match
prevent

Mandates enforcement of approved access authorizations, helping block unauthorized privilege escalations attempted via the flawed plugin.

References