The e-plugins Lawyer Directory plugin versions up to 1.3.3 contain an Incorrect Privilege Assignment vulnerability (CVE-2025-67966) that permits privilege escalation. This means that users with restricted permissions might exploit this flaw to gain higher-level access than intended. The vulnerability is rated high severity with a CVSS 3.1 base score of 8.8, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix has been disclosed, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation of this vulnerability could allow an attacker with limited privileges to escalate their access rights, potentially leading to full compromise of the affected Lawyer Directory plugin environment. This could result in unauthorized data access, modification, or disruption of service. The high CVSS score indicates a serious risk to confidentiality, integrity, and availability of the system using the affected plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is available, users should monitor the vendor's communications for updates. Until a fix is released, consider restricting access to the plugin and limiting user privileges to trusted individuals only.