CVE-2025-66068: 
WordPress vulnerability analysis and mitigation

CVE-2025-66068 is a Missing Authorization (Broken Access Control) vulnerability in the InstaWP Connect WordPress plugin that allows unauthenticated attackers to exploit incorrectly configured access control security levels. It affects all versions of the plugin up to and including 0.1.1.9, with version 0.1.2.0 being the first patched release. The vulnerability was reported by researcher Legion Hunter on November 9, 2025, and published by Patchstack on December 12, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization) and falls under OWASP Top 10 category A1: Broken Access Control. The flaw stems from the absence of proper authorization, authentication, or nonce token checks in one or more plugin functions, allowing an unauthenticated network-based attacker to invoke actions that should be restricted to privileged users. Exploitation requires user interaction (UI:R) but no prior privileges, and the attack complexity is low. No public technical write-up or proof-of-concept code has been published at this time (Patchstack).

Successful exploitation of this vulnerability can result in high integrity impact, allowing an unauthenticated attacker to perform privileged actions on affected WordPress sites without authorization. Confidentiality and availability are not directly impacted per the CVSS scoring. Given that InstaWP Connect is a plugin used for WordPress site staging and management, unauthorized access to its functions could potentially allow attackers to manipulate site configurations or staging environments at scale, as Patchstack notes this class of vulnerability is commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or popularity (Patchstack).

No confirmed in-the-wild exploitation has been reported at this time, and no public exploit code or proof-of-concept is known to exist. The EPSS score is very low at approximately 0.017%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack has flagged it as expected to become exploited and has issued a virtual patch (mitigation rule) for its users (Patchstack).

The vendor InstaWP has released version 0.1.2.0 of the InstaWP Connect plugin, which resolves this vulnerability. WordPress site administrators should update the plugin to version 0.1.2.0 or later immediately. Patchstack users benefit from an automatically applied virtual patch (mitigation rule) that blocks exploitation attempts until the plugin is updated; Patchstack also supports auto-update for vulnerable plugins. If an immediate update is not possible, site owners should contact their hosting provider or web developer for assistance (Patchstack).

The vulnerability was discovered and disclosed through Patchstack's Vulnerability Disclosure Program (VDP), with researcher Legion Hunter credited for the find. No significant broader media coverage or notable researcher commentary beyond the Patchstack advisory has been identified at this time (Patchstack).