CVE-2025-67970
Awaiting Analysis Awaiting Analysis - Queue
Missing Authorization in Vertim Schedula Allows Unauthorized Access

Publication date: 2026-02-20

Last updated on: 2026-04-27

Assigner: Patchstack

Description
Missing Authorization vulnerability in vertim Schedula schedula-smart-appointment-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Schedula: from n/a through <= 1.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-20
Last Modified
2026-04-27
Generated
2026-06-16
AI Q&A
2026-02-20
EPSS Evaluated
2026-06-15
NVD
CVE-2025-67970
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
schedula schedula-smart-appointment-booking to 1.0 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

I don't know

Executive Summary

CVE-2025-67970 is a Broken Access Control vulnerability in the WordPress Schedula Plugin versions up to and including 1.0.

The issue is caused by missing authorization, authentication, or nonce token checks within certain plugin functions.

This allows unauthenticated users to perform actions that should be restricted to higher privileged users.

It is classified under the OWASP Top 10 category A1: Broken Access Control and has a CVSS score of 5.9, indicating moderate severity.

Impact Analysis

This vulnerability allows unauthenticated users to bypass access controls and perform privileged actions within the Schedula plugin.

As a result, attackers could manipulate appointment bookings or other sensitive functions without proper authorization.

This can lead to unauthorized data access, modification, or disruption of service, potentially compromising the integrity and availability of the affected system.

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability involves missing authorization checks in the WordPress Schedula Plugin up to version 1.0, allowing unauthenticated users to perform privileged actions.'}, {'type': 'paragraph', 'content': "Detection can focus on monitoring for unauthorized access attempts or suspicious activity targeting the plugin's endpoints or functions that require higher privileges."}, {'type': 'paragraph', 'content': 'Patchstack has issued mitigation rules to block attacks targeting this flaw, which may include detection signatures or rules for web application firewalls.'}, {'type': 'paragraph', 'content': 'However, no specific commands or detection scripts are provided in the available resources.'}] [1]

Mitigation Strategies

The primary immediate step is to update the WordPress Schedula Plugin to version 1.1 or later, where the vulnerability has been patched.

Until the update can be applied, users can implement Patchstack mitigation rules which block attacks targeting this vulnerability.

Additionally, enabling automatic mitigation and auto-update features provided by Patchstack can enhance protection against exploitation.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-67970. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart