CVE-2025-69183
Published: 22 January 2026
Summary
CVE-2025-69183 is a high-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 29.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2025-69183 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the Hospital Doctor Directory WordPress plugin developed by e-plugins. The flaw enables privilege escalation and affects the hospital-doctor-directory plugin in all versions from n/a through 1.3.9.
The vulnerability can be exploited by an attacker with low privileges (PR:L) over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N), without changing the scope (S:U). Successful exploitation grants high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), resulting in a CVSS v3.1 base score of 8.8.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/hospital-doctor-directory/vulnerability/wordpress-hospital-doctor-directory-plugin-1-3-9-privilege-escalation-vulnerability?_s_id=cve.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3916
Vulnerability details
Incorrect Privilege Assignment vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Privilege Escalation.This issue affects Hospital Doctor Directory: from n/a through <= 1.3.9.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct privilege escalation via incorrect privilege assignment in a web plugin (exploitable by low-priv authenticated users).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces the principle of least privilege, directly mitigating incorrect privilege assignment that enables low-privileged attackers to escalate privileges in the Hospital Doctor Directory plugin.
Requires enforcement of approved access authorizations, countering the plugin's flawed privilege enforcement mechanism.
Mandates proper management and review of accounts and associated privileges, preventing exploitation of privilege escalation flaws like this CVE.