CVE-2025-66086: 
WordPress vulnerability analysis and mitigation

CVE-2025-66086 is a Missing Authorization (Broken Access Control) vulnerability in the Cozy Vision SMS Alert Order Notifications WordPress plugin. It affects all versions up to and including 3.8.8, allowing unauthenticated attackers to exploit incorrectly configured access control security levels. The vulnerability was reported on November 5, 2025, published on November 21, 2025, and patched in version 3.8.9 released December 5, 2025. It carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks — specifically missing authentication or nonce token validation — on one or more functions. This allows an unauthenticated network attacker to invoke functionality that should be restricted to privileged users. The flaw is categorized under OWASP Top 10 A1: Broken Access Control, and exploitation requires no user interaction and low attack complexity (Patchstack).

Successful exploitation allows an unauthenticated attacker to perform actions reserved for higher-privileged users within the SMS Alert Order Notifications plugin, resulting in a low integrity impact with no confidentiality or availability impact. The scope is limited to the affected WordPress installation, but the nature of broken access control in WordPress plugins makes these vulnerabilities suitable for mass-exploit campaigns targeting thousands of sites simultaneously. No data exfiltration or remote code execution has been identified as a direct consequence (Patchstack).

The vulnerability requires no authentication and no user interaction, making it trivially exploitable by any remote attacker. The EPSS score is approximately 0.04%, indicating a low probability of active exploitation in the near term. No public proof-of-concept exploit code, active in-the-wild exploitation, or threat actor attribution has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns against WordPress sites (Patchstack).

The vulnerability is patched in SMS Alert Order Notifications version 3.8.9, released December 5, 2025. Site administrators should update the plugin to version 3.8.9 or later immediately. If an immediate update is not possible, site owners should consult their hosting provider or web developer for assistance, or use a security solution such as Patchstack with auto-update enabled for vulnerable plugins (Patchstack).