CVE-2025-66072: 
WordPress vulnerability analysis and mitigation

CVE-2025-66072 is a Missing Authorization (Broken Access Control) vulnerability in the UsersWP WordPress plugin developed by Stiofan (AyeCode). It affects all versions up to and including 1.2.47, allowing unauthenticated network attackers to exploit incorrectly configured access control security levels. The vulnerability was reported by researcher Legion Hunter on October 26, 2025, and publicly disclosed on November 21–25, 2025. It carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), corresponding to OWASP Top 10 category A1: Broken Access Control. The flaw stems from a missing authorization, authentication, or nonce token check in one or more plugin functions, enabling an unauthenticated user to invoke actions that should be restricted to higher-privileged roles. Exploitation requires no user interaction and can be performed remotely over the network with low attack complexity (Patchstack). No public proof-of-concept code has been identified at this time.

Successful exploitation allows an unauthenticated attacker to perform unauthorized actions that should be restricted to privileged users, resulting in a low integrity impact with no direct confidentiality or availability impact per the CVSS scoring. In practice, broken access control vulnerabilities in WordPress plugins are frequently leveraged in mass-exploit campaigns targeting thousands of sites simultaneously, regardless of site size or popularity. The specific privileged actions accessible without authorization depend on the plugin's internal function set, but could include unauthorized data modification or manipulation of user-related settings (Patchstack).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time (Patchstack). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.028%, indicating a very low probability of exploitation in the near term. Patchstack rates this as low priority with no impactful threat currently observed, though similar broken access control issues in WordPress plugins have historically been used in opportunistic mass-scanning campaigns.

The vulnerability is patched in UsersWP version 1.2.48. Site administrators should update the plugin immediately to version 1.2.48 or later via the WordPress admin dashboard or by downloading the latest release from the plugin repository. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, site owners should consult their hosting provider or web developer, and consider implementing a web application firewall (WAF) rule to restrict unauthorized access to sensitive plugin endpoints (Patchstack).

The vulnerability was covered in the Wordfence Intelligence Weekly WordPress Vulnerability Report for the period of November 24–30, 2025, as part of routine WordPress security intelligence reporting (Wordfence Blog). Patchstack, the assigning CNA, classified it as low priority with no impactful threat, and the broader security community has not raised significant concern given the limited impact scope.