CVE-2025-66083: 
WordPress vulnerability analysis and mitigation

CVE-2025-66083 is a Missing Authorization (Broken Access Control) vulnerability in the WpEvently WordPress plugin (slug: mage-eventpress) developed by Magepeople Inc. It affects all versions up to and including 5.0.4, allowing unauthenticated attackers to exploit incorrectly configured access control security levels. The vulnerability was reported by researcher Legion Hunter on November 4, 2025, and published by Patchstack on December 4, 2025. It carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization, authentication, or nonce token checks on one or more functions (Patchstack). This allows an unauthenticated remote attacker to invoke privileged plugin functionality without possessing the required permissions. The attack vector is network-based, requires no user interaction, and has low attack complexity, making it straightforward to exploit at scale. No public proof-of-concept code has been identified at this time.

Successful exploitation allows an unauthenticated attacker to perform unauthorized actions within the WpEvently plugin, resulting in a low integrity impact with no confidentiality or availability impact per the CVSS scoring (Patchstack). In practice, this could allow attackers to modify event-related data or trigger privileged plugin operations on affected WordPress sites. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting large numbers of WordPress sites simultaneously, regardless of site size or popularity.

No active in-the-wild exploitation has been confirmed, and Patchstack rates the priority as Low, noting the issue is unlikely to be exploited (Patchstack). The EPSS score is approximately 0.033%, indicating a very low probability of exploitation in the near term. No exploit kits, weaponized code, or threat actor attribution have been identified. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

The vendor has released a patched version of the WpEvently plugin. Administrators should update to version 5.0.5 or later immediately to remediate the vulnerability (Patchstack). If an immediate update is not possible, site owners should contact their hosting provider or web developer for assistance. Patchstack users can leverage the platform's auto-update feature for vulnerable plugins as an interim measure.

Patchstack, which coordinated the disclosure through its Active VDP program, classifies this as a low-priority issue with no impactful threat, and the security community has not generated notable commentary or media coverage around this vulnerability (Patchstack).