Cyber Resilience

CVE-2025-67966

High

Published: 22 January 2026

Published
22 January 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0042 33.6th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-67966 is a high-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 33.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and AC-6 (Least Privilege).

Deeper analysis

CVE-2025-67966 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the Lawyer Directory WordPress plugin by e-plugins, enabling privilege escalation. The issue affects the lawyer-directory plugin from unknown initial versions through 1.3.3.

With a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the vulnerability is exploitable over the network by an authenticated attacker with low privileges. No user interaction is required, and successful exploitation allows the attacker to achieve high impacts on confidentiality, integrity, and availability, potentially leading to full system compromise.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/lawyer-directory/vulnerability/wordpress-lawyer-directory-plugin-1-3-3-privilege-escalation-vulnerability?_s_id=cve.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability details

Incorrect Privilege Assignment vulnerability in e-plugins Lawyer Directory lawyer-directory allows Privilege Escalation.This issue affects Lawyer Directory: from n/a through <= 1.3.3.

CWE(s)
CWE-266

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Direct privilege escalation via incorrect privilege assignment in web plugin (authenticated low-priv to high impact).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-33179Shared CWE-266
CVE-2024-49644Shared CWE-266
CVE-2024-56280Shared CWE-266
CVE-2026-42758Shared CWE-266
CVE-2026-32530Shared CWE-266
CVE-2025-22736Shared CWE-266
CVE-2026-48879Shared CWE-266
CVE-2026-25414Shared CWE-266
CVE-2025-62645Shared CWE-266
CVE-2026-3121Shared CWE-266

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-6 Least Privilege good match
prevent

Enforces least privilege to restrict low-privilege authenticated users from escalating via the plugin's incorrect privilege assignment.

AC-2 Account Management good match
prevent

Manages and reviews account privileges to prevent and correct improper assignments exploited by the Lawyer Directory plugin vulnerability.

SI-2 Flaw Remediation good match
prevent

Mandates timely remediation of flaws like CVE-2025-67966 by patching the vulnerable Lawyer Directory plugin to version >1.3.3.

References