CVE-2025-67574: 
WordPress vulnerability analysis and mitigation

CVE-2025-67574 is a Missing Authorization vulnerability in the wpdevart Booking Calendar, Appointment Booking System WordPress plugin. It allows unauthenticated remote attackers to exploit incorrectly configured access control security levels. All versions of the plugin through 3.2.30 are affected. The vulnerability was published on December 9, 2025, and was assigned by Patchstack. It carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to verify whether a requesting user has the appropriate permissions before executing certain actions or exposing data. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote actor. The specific plugin functionality lacking authorization checks has not been publicly detailed in available sources, but the vulnerability class typically involves unprotected AJAX handlers or REST API endpoints that perform sensitive operations without capability checks (Patchstack).

Successful exploitation results in a low-level confidentiality impact — an unauthenticated attacker may be able to access restricted booking data, appointment records, or other information managed by the plugin that should require authentication or elevated privileges. There is no assessed integrity or availability impact based on the CVSS scoring. The scope is limited to the affected WordPress installation, but exposure of booking/appointment data could include personally identifiable information (PII) of site visitors (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-67574 at this time. The EPSS score is approximately 0.04%, indicating a low probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Patchstack).

WordPress site administrators should update the Booking Calendar, Appointment Booking System plugin by wpdevart to a version above 3.2.30 as soon as a patched release is available. Until a patch is confirmed, consider temporarily deactivating the plugin if booking functionality is not critical, or restricting access to the WordPress site via IP allowlisting at the web server or firewall level. Monitor the official WordPress plugin repository and wpdevart's release notes for a patched version (Patchstack).