Cyber Posture

CVE-2025-67915

High

Published: 08 January 2026

Published
08 January 2026
Modified
27 April 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0010 27.2th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-67915 is an Authentication Bypass Using an Alternate Path or Channel vulnerability (CWE-288) in the Timetics WordPress plugin by Arraytics. This flaw allows Authentication Abuse and affects Timetics versions from n/a through 1.0.46.

With a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the vulnerability enables remote exploitation by unauthenticated attackers requiring low complexity and no user interaction. Successful exploitation grants attackers the ability to bypass authentication mechanisms, potentially leading to high-impact compromise of confidentiality, integrity, and availability.

The Patchstack advisory provides further details on this WordPress Timetics plugin 1.0.46 broken authentication vulnerability, including mitigation guidance: https://patchstack.com/database/Wordpress/Plugin/timetics/vulnerability/wordpress-timetics-plugin-1-0-46-broken-authentication-vulnerability?_s_id=cve.

Details

CWE(s)
CWE-288

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The vulnerability is an authentication bypass in a public-facing WordPress plugin, directly enabling exploitation of a public-facing application for unauthorized access.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References