Cyber Resilience

CVE-2025-67967

High

Published: 22 January 2026

Published
22 January 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
EPSS Score 0.0002 5.6th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-67967 is a high-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 7.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 5.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-67967 is a missing authorization vulnerability (CWE-862) in the Lawyer Directory WordPress plugin by e-plugins (lawyer-directory). It enables exploiting incorrectly configured access control security levels and affects all versions of the plugin from n/a through 1.3.3. The issue received a CVSS v3.1 base score of 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L), indicating high severity due to network accessibility, low attack complexity, and impacts across confidentiality, integrity, and availability.

The vulnerability can be exploited by low-privileged users (PR:L) over the network with low complexity and no user interaction required. Attackers can achieve low confidentiality impact, high integrity impact (such as unauthorized data modification), and low availability impact within the unchanged scope.

Patchstack's advisory provides details on the broken access control vulnerability in Lawyer Directory plugin version 1.3.3, available at https://patchstack.com/database/Wordpress/Plugin/lawyer-directory/vulnerability/wordpress-lawyer-directory-plugin-1-3-3-broken-access-control-vulnerability?_s_id=cve.

EU & UK References

Vulnerability details

Missing Authorization vulnerability in e-plugins Lawyer Directory lawyer-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lawyer Directory: from n/a through <= 1.3.3.

CWE(s)
CWE-862

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Missing authorization (CWE-862) in public-facing WordPress plugin directly enables low-privileged authenticated users to perform unauthorized high-integrity actions, mapping to exploitation for privilege escalation and public-facing application exploitation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-4100Shared CWE-862
CVE-2026-32501Shared CWE-862
CVE-2025-31194Shared CWE-862
CVE-2026-6963Shared CWE-862
CVE-2024-9195Shared CWE-862
CVE-2025-6380Shared CWE-862
CVE-2026-0506Shared CWE-862
CVE-2025-2110Shared CWE-862
CVE-2025-27270Shared CWE-862
CVE-2026-6510Shared CWE-862

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Directly enforces approved authorizations for access to resources, addressing the missing authorization vulnerability that allows low-privileged users to bypass controls in the Lawyer Directory plugin.

AC-6 Least Privilege partial match
prevent

Applies least privilege to restrict low-privileged users from performing unauthorized actions despite flawed plugin access controls.

SI-2 Flaw Remediation good match
prevent

Requires timely remediation of flaws like the missing authorization in Lawyer Directory versions through <=1.3.3, preventing exploitation via patching.

References