CVE-2025-67966
Published: 22 January 2026
Summary
CVE-2025-67966 is a high-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 6.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces least privilege to restrict low-privilege authenticated users from escalating via the plugin's incorrect privilege assignment.
Manages and reviews account privileges to prevent and correct improper assignments exploited by the Lawyer Directory plugin vulnerability.
Mandates timely remediation of flaws like CVE-2025-67966 by patching the vulnerable Lawyer Directory plugin to version >1.3.3.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct privilege escalation via incorrect privilege assignment in web plugin (authenticated low-priv to high impact).
NVD Description
Incorrect Privilege Assignment vulnerability in e-plugins Lawyer Directory lawyer-directory allows Privilege Escalation.This issue affects Lawyer Directory: from n/a through <= 1.3.3.
Deeper analysisAI
CVE-2025-67966 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the Lawyer Directory WordPress plugin by e-plugins, enabling privilege escalation. The issue affects the lawyer-directory plugin from unknown initial versions through 1.3.3.
With a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the vulnerability is exploitable over the network by an authenticated attacker with low privileges. No user interaction is required, and successful exploitation allows the attacker to achieve high impacts on confidentiality, integrity, and availability, potentially leading to full system compromise.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/lawyer-directory/vulnerability/wordpress-lawyer-directory-plugin-1-3-3-privilege-escalation-vulnerability?_s_id=cve.
Details
- CWE(s)