CVE-2025-66087: 
WordPress vulnerability analysis and mitigation

CVE-2025-66087 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress PropertyHive plugin by Property Hive. It affects all versions up to and including 2.1.12, and was patched in version 2.1.13. The vulnerability was reported on October 25, 2025, and publicly disclosed on November 21–24, 2025. It carries a CVSS v3.1 base score of 5.3 (Medium) per NVD, and a CVSS score of 4.3 (Low) per Patchstack (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), corresponding to OWASP Top 10 category A1: Broken Access Control. It arises from a missing authorization, authentication, or nonce token check in a function within the PropertyHive plugin, allowing a low-privileged user (at the Subscriber level or above) to perform actions that should be restricted to higher-privileged roles. No authentication bypass is required beyond having a basic subscriber account on the affected WordPress site (Patchstack).

Successful exploitation allows an authenticated attacker with minimal privileges (Subscriber-level) to execute actions beyond their intended authorization level within the PropertyHive plugin. The primary impact is on confidentiality (low), with no direct impact on integrity or availability per the CVSS scoring. While the severity is rated low by Patchstack, such broken access control vulnerabilities in WordPress plugins are commonly leveraged in mass-exploit campaigns targeting large numbers of sites regardless of their traffic or popularity (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-66087. The EPSS score is approximately 0.04%, indicating a very low probability of exploitation in the near term. The vulnerability requires at least Subscriber-level authentication, which limits opportunistic exploitation. Patchstack rates the priority as Low and notes it is unlikely to be exploited, though it acknowledges that similar broken access control issues are used in mass-exploit campaigns against WordPress sites (Patchstack). It is not listed in the CISA KEV catalog.

The vulnerability is fully remediated in PropertyHive version 2.1.13. Site administrators should update the PropertyHive plugin to version 2.1.13 or later immediately. If an immediate update is not possible, site owners should contact their hosting provider or web developer for assistance, or use Patchstack's virtual patching feature to mitigate the risk without updating (Patchstack).

Wordfence included CVE-2025-66087 in its weekly WordPress vulnerability report covering November 24–30, 2025, noting it as part of the broader landscape of WordPress plugin vulnerabilities (Wordfence Blog). No significant additional commentary from researchers or the broader security community has been identified.