CVE-2025-66076: 
WordPress vulnerability analysis and mitigation

CVE-2025-66076 is an unauthenticated Broken Access Control vulnerability in the Woostify Sites Library WordPress plugin affecting versions 1.6.2 and earlier. The flaw allows unauthenticated network attackers to bypass authorization controls and perform unauthorized actions. It was reported by researcher Legion Hunter on October 21, 2025, and published by Patchstack on June 29, 2026. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack, Github Advisory).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform proper authorization checks when an actor attempts to access a resource or perform an action. Specifically, one or more plugin functions lack adequate authentication, nonce token, or capability checks, allowing unauthenticated users to invoke functionality intended for privileged users. The attack vector is network-based, requires no privileges or user interaction, and has low attack complexity, making it automatable (Patchstack, Github Advisory).

Successful exploitation allows an unauthenticated attacker to bypass access controls and modify data or settings within the Woostify Sites Library plugin, resulting in a low integrity impact. There is no confirmed confidentiality or availability impact. While the individual impact is limited, this class of vulnerability is commonly leveraged in mass-exploit campaigns targeting large numbers of WordPress sites simultaneously (Patchstack).

Users should upgrade the Woostify Sites Library plugin to a version newer than 1.6.2 as soon as a patched release becomes available. If an immediate upgrade is not possible, site administrators should consider disabling the plugin until a fix is applied, or consult their hosting provider for assistance. Patchstack users benefit from virtual patching that can mitigate the vulnerability without requiring a plugin update (Patchstack, Github Advisory).

The vulnerability was included in Wordfence's weekly WordPress vulnerability report for the period of June 29 to July 5, 2026, indicating routine tracking by the WordPress security community. No notable researcher commentary or significant media coverage beyond standard vulnerability database listings has been observed.