CVE-2025-66096: 
WordPress vulnerability analysis and mitigation

CVE-2025-66096 is a Missing Authorization vulnerability in the "Table Block by Tableberg" WordPress plugin, developed by Imtiaz Rayhan. It allows authenticated attackers with low-level privileges to exploit incorrectly configured access control security levels. All versions up to and including 0.6.9 are affected. The vulnerability was published on November 21, 2025, and carries a CVSS v3.1 base score of 4.3 (Medium) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify that a requesting user has the necessary permissions before performing certain actions. The attack vector is network-based, requires low privileges (an authenticated user account), and no user interaction. The vulnerability falls under the broader category of Broken Access Control, where restricted functionality is accessible to users who should not have permission to invoke it (Feedly, Patchstack).

Successful exploitation results in a low confidentiality impact, with no integrity or availability impact, and the scope remains unchanged. An authenticated attacker with minimal privileges (e.g., a subscriber-level WordPress account) could access data or functionality that should be restricted to higher-privileged roles. The practical risk is limited to information disclosure or unauthorized access to plugin-controlled resources on the affected WordPress site (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-66096. The EPSS score is approximately 0.022% (0.000220), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid (low-privilege) account on the target WordPress site, limiting the attack surface (Feedly).

Users should update the "Table Block by Tableberg" WordPress plugin to a version beyond 0.6.9 that addresses this authorization flaw. If no patched version is yet available, site administrators should consider deactivating the plugin until a fix is released, or restricting site registration to prevent untrusted users from obtaining low-privilege accounts. Regularly auditing installed WordPress plugins for access control issues is also recommended (Patchstack).