CVE-2025-69293
Published: 22 January 2026
Summary
CVE-2025-69293 is a high-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 19.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-69293 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the e-plugins Final User WordPress plugin (final-user), which allows privilege escalation. This issue affects versions from n/a through 1.2.5, as published on 2026-01-22 with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability can be exploited by an authenticated attacker with low privileges over the network, requiring low attack complexity and no user interaction. Successful exploitation enables privilege escalation, resulting in high impacts to confidentiality, integrity, and availability.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/final-user/vulnerability/wordpress-final-user-plugin-1-2-5-privilege-escalation-vulnerability?_s_id=cve details this privilege escalation vulnerability in the WordPress Final User plugin version 1.2.5.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3895
Vulnerability details
Incorrect Privilege Assignment vulnerability in e-plugins Final User final-user allows Privilege Escalation.This issue affects Final User: from n/a through <= 1.2.5.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct mapping to Exploitation for Privilege Escalation due to incorrect privilege assignment enabling authenticated low-priv users to escalate in the WordPress plugin.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the privilege escalation flaw in the Final User WordPress plugin by requiring timely identification, reporting, and remediation through patching affected versions up to 1.2.5.
Enforces the principle of least privilege, mitigating incorrect privilege assignment (CWE-266) by ensuring low-privilege authenticated users cannot perform unauthorized high-privilege actions even if plugin logic fails.
Requires system-wide enforcement of approved access control policies, countering the plugin's flawed privilege enforcement that allows network-based escalation by low-privilege users.