CVE-2025-69378
Published: 20 February 2026
Summary
CVE-2025-69378 is a high-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 5.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-69378 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the Product Filter for WooCommerce plugin (prdctfltr), also known as XforWooCommerce Product Filter for WooCommerce, which enables privilege escalation. This issue affects the plugin from unknown initial versions through version 9.1.2 and is present in WordPress environments utilizing this extension.
The vulnerability carries a CVSS v3.1 base score of 7.2 (High), with a vector of AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. Exploitation requires an authenticated attacker with high privileges, accessible over the network, with low attack complexity and no user interaction. A successful exploit allows the attacker to achieve high impacts on confidentiality, integrity, and availability through privilege escalation.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/prdctfltr/vulnerability/wordpress-product-filter-for-woocommerce-plugin-9-1-2-privilege-escalation-vulnerability?_s_id=cve) documents this privilege escalation vulnerability in the WordPress Product Filter for WooCommerce plugin version 9.1.2. Security practitioners should consult the advisory for specific mitigation guidance, such as updating to a patched version beyond 9.1.2.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-207961
Vulnerability details
Incorrect Privilege Assignment vulnerability in XforWooCommerce Product Filter for WooCommerce prdctfltr allows Privilege Escalation.This issue affects Product Filter for WooCommerce: from n/a through <= 9.1.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Incorrect privilege assignment in the WordPress plugin directly enables privilege escalation via exploitation of the vulnerable component.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly counters incorrect privilege assignment by ensuring accounts and processes operate with only the minimum permissions required, blocking escalation paths in the vulnerable plugin.
Enforces authorization checks on all privileged operations, preventing the plugin's flawed privilege logic from granting unauthorized high-impact access.
Requires timely application of the vendor patch beyond version 9.1.2, eliminating the underlying incorrect privilege assignment flaw.