CVE-2026-25414
Published: 25 March 2026
Summary
CVE-2026-25414 is a high-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 20.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-25414 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the WPBookit Pro WordPress plugin from iqonicdesign, specifically in the wpbookit-pro component. This flaw enables privilege escalation and affects all versions of WPBookit Pro from n/a through 1.6.18. The vulnerability was published on 2026-03-25 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An authenticated attacker with low privileges (PR:L), such as a subscriber role, can exploit this vulnerability remotely over the network with low attack complexity and no user interaction. Exploitation allows the attacker to achieve high impacts on confidentiality, integrity, and availability, potentially leading to full administrative control or arbitrary code execution within the affected WordPress site.
The Patchstack advisory provides details on this vulnerability, available at https://patchstack.com/database/Wordpress/Plugin/wpbookit-pro/vulnerability/wordpress-wpbookit-pro-plugin-1-6-18-privilege-escalation-vulnerability?_s_id=cve.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-15721
Vulnerability details
Incorrect Privilege Assignment vulnerability in iqonicdesign WPBookit Pro wpbookit-pro allows Privilege Escalation.This issue affects WPBookit Pro: from n/a through <= 1.6.18.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE describes authenticated privilege escalation via incorrect privilege assignment (CWE-266) in a WordPress plugin, directly enabling T1068 Exploitation for Privilege Escalation to gain admin-level access or RCE.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Employs least privilege to restrict user access to only necessary permissions, directly countering the incorrect privilege assignment that enables escalation from low-privilege roles like subscriber in WPBookit Pro.
Enforces approved access control policies and authorizations, preventing the privilege escalation exploit in the WPBookit Pro plugin despite flawed privilege checks.
Requires identification, reporting, and timely remediation of flaws like this privilege escalation vulnerability in WPBookit Pro versions through 1.6.18 via patching.