CVE-2025-69340
Published: 05 March 2026
Summary
CVE-2025-69340 is a high-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring an access control policy ensures authorization checks are defined and applied for critical functions.
Reviews of access controls detect missing authorization checks on critical functions or resources.
Documenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review.
Requiring attribute association with information prevents authorization from being performed without necessary security or privacy context.
Mandating authorization prior to allowing remote connections addresses missing authorization for remote access.
Mandating authorization before wireless connections are allowed prevents missing authorization for wireless access.
The control requires authorization before allowing mobile device connections, directly mitigating missing authorization for system access.
Requiring approvals for account creation and specifying authorizations ensures authorization is not missing for system access.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization (CWE-862) in public-facing WordPress plugin directly enables unauthenticated network exploitation (T1190) resulting in application/system DoS via crafted requests (T1499.004).
NVD Description
Missing Authorization vulnerability in BuddhaThemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through <= 1.0.3.
Deeper analysisAI
CVE-2025-69340 is a missing authorization vulnerability in the WeDesignTech Ultimate Booking Addon WordPress plugin from BuddhaThemes, identified as wedesigntech-ultimate-booking-addon. The issue, classified under CWE-862, enables exploiting incorrectly configured access control security levels and affects all versions from n/a through 1.0.3. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), highlighting its potential for significant availability disruption without impacting confidentiality or integrity.
Unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required. Exploitation results in high availability impact, typically manifesting as a denial-of-service condition against the affected WordPress site.
Patchstack has published details on this broken access control vulnerability in the WeDesignTech Ultimate Booking Addon plugin version 1.0.3, available at https://patchstack.com/database/Wordpress/Plugin/wedesigntech-ultimate-booking-addon/vulnerability/wordpress-wedesigntech-ultimate-booking-addon-plugin-1-0-3-broken-access-control-vulnerability-2?_s_id=cve. Security practitioners should consult this advisory for mitigation guidance.
Details
- CWE(s)