CVE-2025-69292
Published: 22 January 2026
Summary
CVE-2025-69292 is a high-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 19.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-69292 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the WP Membership plugin (wp-membership) by e-plugins for WordPress. This issue enables privilege escalation and affects all versions from n/a through 1.6.4.
With a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the vulnerability can be exploited by an attacker possessing low privileges, such as an authenticated user with subscriber-level access. Exploitation occurs over the network with low complexity and requires no user interaction, allowing the attacker to achieve high impacts on confidentiality, integrity, and availability through escalated privileges.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-membership/vulnerability/wordpress-wp-membership-plugin-1-6-4-privilege-escalation-vulnerability?_s_id=cve.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3881
Vulnerability details
Incorrect Privilege Assignment vulnerability in e-plugins WP Membership wp-membership allows Privilege Escalation.This issue affects WP Membership: from n/a through <= 1.6.4.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct privilege escalation via incorrect privilege assignment in authenticated WordPress context.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the software flaw in the WP Membership plugin causing incorrect privilege assignment and privilege escalation.
Enforces least privilege to minimize the privileges available for escalation and limit impact if exploited.
Ensures proper account management and authorization allocation to prevent incorrect privilege assignments like those in the vulnerable plugin.