CVE-2025-67967: 
WordPress vulnerability analysis and mitigation

CVE-2025-67967 is a Missing Authorization vulnerability in the e-plugins Lawyer Directory WordPress plugin that allows authenticated attackers to exploit incorrectly configured access control security levels. It affects all versions of the Lawyer Directory plugin through 1.3.3. The vulnerability was disclosed on January 22, 2026, by Patchstack, and carries a CVSS v3.1 base score of 7.6 (High) as assessed by CISA-ADP (Patchstack, Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing sensitive actions. The attack vector is network-based and requires low-level authenticated access (e.g., a subscriber or contributor account), with no user interaction required. This type of flaw typically arises when WordPress REST API endpoints or AJAX handlers lack proper capability checks, allowing lower-privileged users to perform actions reserved for administrators (Patchstack).

Successful exploitation can result in high integrity impact, low confidentiality impact, and low availability impact on the affected WordPress site. An authenticated attacker with minimal privileges could manipulate or delete lawyer directory listings, modify plugin settings, or perform unauthorized administrative actions within the plugin's scope. While the vulnerability does not directly enable remote code execution, unauthorized data modification could be leveraged to deface content or disrupt the directory service (Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-67967. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at least a low-privileged authenticated account on the target WordPress site, which limits opportunistic mass exploitation (Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Lawyer Directory plugin (version ≤ 1.3.3) using tools like WPScan or by checking the plugin's readme.txt file at wp-content/plugins/lawyer-directory/readme.txt.
2. Obtain low-privileged access: Register or obtain credentials for a low-privileged WordPress account (e.g., subscriber or contributor role) on the target site.
3. Identify unprotected endpoints: Enumerate the plugin's registered AJAX actions or REST API endpoints that lack proper current_user_can() capability checks.
4. Craft malicious request: Send an authenticated HTTP request (with valid nonce/cookie) to the vulnerable endpoint, performing an action that should be restricted to administrators — such as modifying, adding, or deleting lawyer directory entries.
5. Achieve unauthorized action: The server processes the request without verifying the user's authorization level, resulting in unauthorized data modification or access (Patchstack).

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/admin-ajax.php or REST API endpoints associated with the lawyer-directory plugin from low-privileged user accounts.
• Logs: Unexpected modifications to lawyer directory entries in the WordPress database (wp_posts or custom plugin tables) by non-administrator user IDs.
• File System: Presence of Lawyer Directory plugin version 1.3.3 or earlier at wp-content/plugins/lawyer-directory/.
• Network: Repeated authenticated requests to plugin-specific AJAX actions from the same IP address in a short time window, potentially indicating automated exploitation attempts.

Users should update the Lawyer Directory plugin to a version beyond 1.3.3 that addresses this missing authorization flaw. If no patched version is yet available from e-plugins, administrators should consider deactivating and removing the plugin until a fix is released. As a general hardening measure, restrict WordPress user registrations and limit the number of accounts with any authenticated access to the site (Patchstack).