Cyber Posture

CVE-2025-67953

High

Published: 22 January 2026

Published
22 January 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0006 19.2th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-67953 is a high-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 19.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Requires timely identification, reporting, and correction of flaws like this privilege escalation vulnerability in the Booking Activities WordPress plugin.

prevent

Enforces the principle of least privilege, directly countering incorrect privilege assignment that enables unauthenticated escalation.

prevent

Mandates enforcement of approved access authorizations, helping block unauthorized privilege escalations attempted via the flawed plugin.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Direct privilege escalation via unauthenticated remote exploitation of a public-facing WordPress plugin.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Incorrect Privilege Assignment vulnerability in Booking Activities Team Booking Activities booking-activities allows Privilege Escalation.This issue affects Booking Activities: from n/a through <= 1.16.44.

Deeper analysisAI

CVE-2025-67953 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the Booking Activities WordPress plugin developed by the Booking Activities Team. This flaw allows for privilege escalation and affects all versions of the plugin from its initial release through version 1.16.44.

The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it can be exploited remotely over the network by unauthenticated attackers without requiring user interaction, though it demands high attack complexity. Successful exploitation enables attackers to achieve high-impact effects on confidentiality, integrity, and availability, specifically through unauthorized privilege escalation within affected WordPress installations.

Patchstack has published details on this vulnerability, including mitigation guidance, available at https://patchstack.com/database/Wordpress/Plugin/booking-activities/vulnerability/wordpress-booking-activities-plugin-1-16-44-privilege-escalation-vulnerability?_s_id=cve. Security practitioners should consult this advisory for patch information and remediation steps.

Details

CWE(s)

CVEs Like This One

CVE-2026-32520Shared CWE-266
CVE-2025-44655Shared CWE-266
CVE-2026-27051Shared CWE-266
CVE-2026-23800Shared CWE-266
CVE-2026-32519Shared CWE-266
CVE-2026-32488Shared CWE-266
CVE-2026-32916Shared CWE-266
CVE-2025-68869Shared CWE-266
CVE-2024-56000Shared CWE-266
CVE-2026-23550Shared CWE-266

References