CVE-2025-67956
Published: 22 January 2026
Summary
CVE-2025-67956 is a high-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-67956 is a missing authorization vulnerability, classified under CWE-862, in the User Registration WordPress plugin (user-registration) developed by wpeverest. This flaw enables exploitation of incorrectly configured access control security levels and affects all versions of the plugin from n/a through 4.4.6. The vulnerability carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high severity due to its network accessibility and potential for significant data exposure.
Unauthenticated attackers can exploit CVE-2025-67956 over the network with low attack complexity and no user interaction. Exploitation grants high confidentiality impact, potentially allowing unauthorized access to sensitive user data, alongside low integrity impact that may enable limited modifications.
The Patchstack advisory provides details on this broken access control vulnerability in the WordPress User Registration plugin version 4.4.6, available at https://patchstack.com/database/Wordpress/Plugin/user-registration/vulnerability/wordpress-user-registration-plugin-4-4-6-broken-access-control-vulnerability?_s_id=cve. Security practitioners should consult it for recommended mitigations and patches.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4027
Vulnerability details
Missing Authorization vulnerability in wpeverest User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through <= 4.4.6.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization (CWE-862) in a public-facing WordPress plugin directly enables remote exploitation of the application for unauthorized data access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for access to information and resources, directly preventing unauthenticated exploitation of the missing authorization flaw in the User Registration plugin.
Requires timely remediation of the specific flaw in the plugin through patching, eliminating the missing authorization vulnerability across affected versions.
Establishes and enforces secure configuration settings for the plugin, mitigating exploitation stemming from incorrectly configured access control security levels.