CVE-2025-67953
Published: 22 January 2026
Summary
CVE-2025-67953 is a high-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 19.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely identification, reporting, and correction of flaws like this privilege escalation vulnerability in the Booking Activities WordPress plugin.
Enforces the principle of least privilege, directly countering incorrect privilege assignment that enables unauthenticated escalation.
Mandates enforcement of approved access authorizations, helping block unauthorized privilege escalations attempted via the flawed plugin.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct privilege escalation via unauthenticated remote exploitation of a public-facing WordPress plugin.
NVD Description
Incorrect Privilege Assignment vulnerability in Booking Activities Team Booking Activities booking-activities allows Privilege Escalation.This issue affects Booking Activities: from n/a through <= 1.16.44.
Deeper analysisAI
CVE-2025-67953 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the Booking Activities WordPress plugin developed by the Booking Activities Team. This flaw allows for privilege escalation and affects all versions of the plugin from its initial release through version 1.16.44.
The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it can be exploited remotely over the network by unauthenticated attackers without requiring user interaction, though it demands high attack complexity. Successful exploitation enables attackers to achieve high-impact effects on confidentiality, integrity, and availability, specifically through unauthorized privilege escalation within affected WordPress installations.
Patchstack has published details on this vulnerability, including mitigation guidance, available at https://patchstack.com/database/Wordpress/Plugin/booking-activities/vulnerability/wordpress-booking-activities-plugin-1-16-44-privilege-escalation-vulnerability?_s_id=cve. Security practitioners should consult this advisory for patch information and remediation steps.
Details
- CWE(s)