CVE-2025-66080: 
WordPress vulnerability analysis and mitigation

CVE-2025-66080 is a Missing Authorization (Broken Access Control) vulnerability in the WP Cookie Notice for GDPR, CCPA & ePrivacy Consent WordPress plugin by WP Legal Pages. It affects all versions up to and including 4.0.3, and was discovered by researcher Legion Hunter on November 3, 2025, and publicly disclosed on December 30, 2025. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium), exploitable by unauthenticated network attackers (Patchstack, Red Hat).

The vulnerability is classified as CWE-862 (Missing Authorization), corresponding to OWASP Top 10 category A1: Broken Access Control. The flaw arises from the absence of proper authorization, authentication, or nonce token checks on one or more plugin functions, allowing unauthenticated users to invoke actions that should be restricted to higher-privileged roles. No user interaction is required, and the attack complexity is low, making it straightforward to trigger remotely over the network (Patchstack).

Successful exploitation results in a limited availability impact — unauthenticated attackers can trigger denial-of-service conditions against affected WordPress sites without any user interaction. There is no assessed impact on confidentiality or integrity based on the CVSS vector. The scope is limited to the affected plugin's functionality, and no lateral movement or data exfiltration risk has been identified (Patchstack, Red Hat).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-66080. The EPSS score is approximately 0.04%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that while vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins, this specific issue is assessed as low priority and unlikely to be exploited (Patchstack).

The vulnerability is patched in version 4.0.4 of the WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin. WordPress site administrators should update the plugin to version 4.0.4 or later immediately. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, site owners should consult their hosting provider or web developer for assistance (Patchstack).

Patchstack, which coordinated the disclosure, classified the vulnerability as low priority with no impactful threat, and credited researcher Legion Hunter for the discovery. No notable broader media coverage or significant community discussion has been identified beyond standard vulnerability database entries (Patchstack).