CVE-2025-67970: 
WordPress vulnerability analysis and mitigation

CVE-2025-67970 is a Missing Authorization (Broken Access Control) vulnerability in the Schedula – Smart Appointment Booking WordPress plugin developed by vertim. The flaw allows unauthenticated remote attackers to exploit incorrectly configured access control security levels, potentially accessing restricted data. All versions up to and including 1.0 are affected. It carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, Patchstack).

The vulnerability is classified under CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks before granting access to certain functionality or data. Because no authentication or privilege is required (PR:N, UI:N), an attacker can send crafted network requests to trigger the misconfigured access control paths. The attack vector is network-based with low complexity, making it straightforward to exploit without user interaction (Feedly).

Successful exploitation results in limited unauthorized disclosure of information (low confidentiality impact), with no direct impact on integrity or availability. An unauthenticated attacker could access appointment-related data or other restricted plugin functionality that should require proper authorization. The scope is unchanged, limiting the blast radius to the affected WordPress installation, though exposed booking data may include personally identifiable information of site users (Feedly).

The EPSS score for CVE-2025-67970 is approximately 0.017% (0.000170), indicating a very low probability of active exploitation in the near term. No public proof-of-concept exploit code, exploit kit integration, or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The low barrier to exploitation (no authentication required, low complexity) does increase theoretical risk for unpatched installations (Feedly).

Users of the Schedula – Smart Appointment Booking WordPress plugin should update to a version beyond 1.0 if a patched release is available from the plugin developer (vertim). If no patched version is yet available, site administrators should consider deactivating or removing the plugin until a fix is released. Additionally, implementing a Web Application Firewall (WAF) rule to restrict unauthorized access to plugin endpoints can serve as a temporary mitigation (Patchstack).

The vulnerability was noted in the Wordfence Intelligence Weekly WordPress Vulnerability Report covering late January to early February 2026, indicating routine tracking by the WordPress security community (Wordfence). No significant vendor statements, researcher commentary, or broader media coverage has been identified beyond standard vulnerability database listings.