CVE-2025-68027
Published: 22 January 2026
Summary
CVE-2025-68027 is a high-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 21.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-68027 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the Themefic Hydra Booking WordPress plugin (hydra-booking), which allows privilege escalation. This issue affects the plugin from unknown initial versions through 1.1.32, as published on 2026-01-22. The vulnerability carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating high severity due to its network accessibility and low exploitation barriers.
An unauthenticated attacker can exploit this vulnerability remotely over the network with low attack complexity and no user interaction. Successful exploitation enables privilege escalation within the affected WordPress environment, resulting in low impacts to confidentiality, integrity, and availability.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/hydra-booking/vulnerability/wordpress-hydra-booking-plugin-1-1-32-privilege-escalation-vulnerability?_s_id=cve) documents this privilege escalation vulnerability in the Hydra Booking plugin up to version 1.1.32.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4005
Vulnerability details
Incorrect Privilege Assignment vulnerability in Themefic Hydra Booking hydra-booking allows Privilege Escalation.This issue affects Hydra Booking: from n/a through <= 1.1.32.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct privilege escalation via unauthenticated remote exploit of public-facing WordPress plugin maps to T1068 (Exploitation for Privilege Escalation) and T1190 (Exploit Public-Facing Application).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces authorization checks so that unauthenticated or low-privilege requests cannot obtain elevated roles in the Hydra Booking plugin.
Requires that accounts and plugin functions operate with only the privileges explicitly needed, blocking the incorrect privilege assignment that enables escalation.
Mandates controlled creation, modification, and review of accounts and role assignments, reducing the chance that the plugin's flawed privilege logic can be exploited.