CVE-2025-67559: 
WordPress vulnerability analysis and mitigation

CVE-2025-67559 is a Missing Authorization (Broken Access Control) vulnerability in the "Online Booking & Scheduling Calendar for WordPress by vcita" plugin. It affects all versions up to and including 4.5.5, and was discovered by researcher Mika and reported on October 13, 2025, with public disclosure on November 12, 2025. The vulnerability was assigned a CVSS v3.1 base score of 5.4 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before executing certain privileged actions. Specifically, a missing authorization, authentication, or nonce token check in one or more plugin functions allows a low-privileged user (e.g., a Subscriber-level account) to perform actions that should be restricted to higher-privileged roles. The attack vector is network-based, requires low privileges, and no user interaction, making it straightforward to exploit for any authenticated WordPress user (Patchstack).

Successful exploitation allows a low-privileged authenticated attacker (Subscriber level or above) to perform unauthorized actions within the WordPress site, resulting in limited integrity and availability impacts. Confidentiality is not directly impacted according to the CVSS assessment. While the individual impact is rated low, Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites simultaneously, regardless of site size or popularity (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is very low at approximately 0.012%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with no impactful threat currently observed (Patchstack).

The vulnerability is patched in version 4.6.0 of the "Online Booking & Scheduling Calendar for WordPress by vcita" plugin. Site administrators should update the plugin to version 4.6.0 or later immediately. If an immediate update is not possible, site owners should contact their hosting provider or web developer for assistance, or use a virtual patching solution such as Patchstack to mitigate the risk until the update can be applied (Patchstack).