CVE-2025-66054: 
WordPress vulnerability analysis and mitigation

CVE-2025-66054 is a Missing Authorization (Broken Access Control) vulnerability in the ThimPress LearnPress WordPress plugin that allows unauthenticated attackers to exploit incorrectly configured access control security levels. It affects LearnPress versions up to and including 4.2.9.4, with version 4.3.0 serving as the patched release. The vulnerability was reported by researcher benzdeus on October 31, 2025, and published by Patchstack on November 30, 2025. It carries a CVSS v3.1 base score of 7.5 (High) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks — such as capability checks or nonce token validation — before executing privileged functions. This allows unauthenticated network-based attackers to invoke actions that should be restricted to higher-privileged users. The attack requires no user interaction, no special privileges, and low complexity, making it accessible to a broad range of threat actors. No specific technical write-up or proof-of-concept code has been publicly disclosed at this time (Patchstack).

Successful exploitation primarily affects integrity, with a CVSS integrity impact rated High and no direct confidentiality or availability impact. An unauthenticated attacker could perform unauthorized privileged actions within the LearnPress plugin — such as modifying course content, enrollment data, or plugin settings — without valid credentials. Given that LearnPress is a widely deployed e-learning platform plugin, exploitation could disrupt course management, tamper with student records, or enable further abuse of the WordPress installation (Patchstack).

No public proof-of-concept exploit code or confirmed in-the-wild exploitation has been reported for CVE-2025-66054. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. Patchstack classifies the priority as Low, noting it is unlikely to be exploited despite the vulnerability class being associated with mass-exploit campaigns targeting WordPress plugins. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack).

The primary remediation is to update the LearnPress plugin to version 4.3.0 or later, which addresses the missing authorization checks. Site administrators unable to update immediately should consult their hosting provider or web developer for assistance. Patchstack users can enable auto-update for vulnerable plugins to receive protection automatically. No specific configuration-based workaround has been published (Patchstack).

The vulnerability was discovered and disclosed through Patchstack's Vulnerability Disclosure Program (VDP) by researcher benzdeus. Patchstack characterizes the risk as low priority with no impactful threat currently observed. Broader community or media coverage beyond standard vulnerability aggregation sites (Vulners, CVEFeed, VulDB) has been minimal (Patchstack).