CVE-2025-66088: 
WordPress vulnerability analysis and mitigation

CVE-2025-66088 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress PropertyHive plugin that allows unauthenticated attackers to exploit incorrectly configured access control security levels. It affects PropertyHive versions up to and including 2.1.12, with version 2.1.13 containing the fix. The vulnerability was reported on October 25, 2025, published by Patchstack on November 24, 2025, and assigned a CVE ID on December 18, 2025. It carries a CVSS v3.1 base score of 7.5 (High) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization, authentication, or nonce token checks on one or more functions. This allows an unauthenticated network attacker to invoke privileged actions that should be restricted to higher-privileged users. The attack vector is network-accessible, requires no user interaction, and has low attack complexity, making it straightforward to exploit remotely. No authentication or special preconditions are required beyond network access to a vulnerable WordPress installation running PropertyHive ≤ 2.1.12 (Patchstack).

Successful exploitation results in a high integrity impact, allowing unauthenticated attackers to perform privileged actions within the PropertyHive plugin — such as modifying property listings, settings, or other plugin-managed data — without authorization. Confidentiality and availability are not directly impacted per the CVSS scoring. Given that PropertyHive is a real estate management plugin, unauthorized data modification could disrupt property listings, corrupt business-critical content, or enable further abuse of the WordPress site (Patchstack).

No public proof-of-concept exploit code or confirmed in-the-wild exploitation has been reported at this time. The EPSS score is approximately 0.017%, indicating a low current probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack classifies it as high priority and notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their traffic or popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the PropertyHive plugin version ≤ 2.1.12 using tools like WPScan, Shodan, or by checking publicly accessible readme.txt files at /wp-content/plugins/propertyhive/readme.txt.
2. Identify unprotected endpoints: Enumerate plugin-specific AJAX actions or REST API endpoints registered by PropertyHive that lack proper capability or nonce checks.
3. Craft malicious request: Send an unauthenticated HTTP POST or GET request to the vulnerable endpoint (e.g., WordPress AJAX handler at /wp-admin/admin-ajax.php with the relevant action parameter, or a REST API route) without supplying authentication credentials.
4. Execute privileged action: The missing authorization check allows the request to succeed, enabling the attacker to modify property data, plugin settings, or other restricted content as if they were a privileged user (Patchstack).

• Network: Unexpected unauthenticated POST requests to /wp-admin/admin-ajax.php with PropertyHive-specific action parameters, or to PropertyHive REST API endpoints, originating from unknown or automated IP addresses.
• Logs: WordPress access logs showing repeated unauthenticated requests to plugin-specific endpoints with HTTP 200 responses; unusual modification timestamps on PropertyHive-related database entries.
• File System: Unexpected changes to PropertyHive plugin configuration files or WordPress database tables associated with property listings or plugin settings.
• Application: Unexplained modifications to property listings, plugin settings, or other PropertyHive-managed content without corresponding authenticated admin activity in WordPress audit logs.

The primary remediation is to update the PropertyHive plugin to version 2.1.13 or later, which contains the fix for this vulnerability. Site administrators who cannot immediately update should consider using a web application firewall (WAF) such as Patchstack, which has issued a virtual patching/mitigation rule to block exploitation attempts until the plugin is updated. Restricting access to WordPress admin endpoints and monitoring for anomalous unauthenticated requests to plugin endpoints are additional defensive measures (Patchstack).

Patchstack, which discovered and disclosed the vulnerability (credited to researcher 'daroo'), classifies it as high priority and warns it is the type of flaw commonly leveraged in mass WordPress exploit campaigns. The vulnerability was noted in the Wordfence Intelligence weekly WordPress vulnerability report for the period of November 24–30, 2025. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified.