CVE-2025-67970
Missing Authorization in Vertim Schedula Allows Unauthorized Access
Publication date: 2026-02-20
Last updated on: 2026-04-27
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| schedula | schedula-smart-appointment-booking | to 1.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
Can you explain this vulnerability to me?
CVE-2025-67970 is a Broken Access Control vulnerability in the WordPress Schedula Plugin versions up to and including 1.0.
The issue is caused by missing authorization, authentication, or nonce token checks within certain plugin functions.
This allows unauthenticated users to perform actions that should be restricted to higher privileged users.
It is classified under the OWASP Top 10 category A1: Broken Access Control and has a CVSS score of 5.9, indicating moderate severity.
How can this vulnerability impact me? :
This vulnerability allows unauthenticated users to bypass access controls and perform privileged actions within the Schedula plugin.
As a result, attackers could manipulate appointment bookings or other sensitive functions without proper authorization.
This can lead to unauthorized data access, modification, or disruption of service, potentially compromising the integrity and availability of the affected system.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability involves missing authorization checks in the WordPress Schedula Plugin up to version 1.0, allowing unauthenticated users to perform privileged actions.'}, {'type': 'paragraph', 'content': "Detection can focus on monitoring for unauthorized access attempts or suspicious activity targeting the plugin's endpoints or functions that require higher privileges."}, {'type': 'paragraph', 'content': 'Patchstack has issued mitigation rules to block attacks targeting this flaw, which may include detection signatures or rules for web application firewalls.'}, {'type': 'paragraph', 'content': 'However, no specific commands or detection scripts are provided in the available resources.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
The primary immediate step is to update the WordPress Schedula Plugin to version 1.1 or later, where the vulnerability has been patched.
Until the update can be applied, users can implement Patchstack mitigation rules which block attacks targeting this vulnerability.
Additionally, enabling automatic mitigation and auto-update features provided by Patchstack can enhance protection against exploitation.