CVE-2025-66097: 
WordPress vulnerability analysis and mitigation

CVE-2025-66097 is a Cross-Site Request Forgery (CSRF) vulnerability in the "I Order Terms" WordPress plugin developed by Igor Jerosimić. It affects all versions of the plugin up to and including 1.5.0. The vulnerability was published on November 21, 2025, and was assigned by Patchstack. It carries a CVSS v3.1 base score of 4.3 (Medium) (Feedly, Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), meaning the plugin fails to properly validate or verify the origin of state-changing requests. An attacker can craft a malicious web page or link that, when visited by an authenticated WordPress administrator or user, triggers unauthorized actions within the I Order Terms plugin without the victim's knowledge. Exploitation requires user interaction (the victim must visit or click a malicious link) and no special privileges on the part of the attacker (Feedly).

Successful exploitation of this CSRF vulnerability allows an attacker to perform unauthorized state-changing actions on behalf of an authenticated user, resulting in a low integrity impact with no confidentiality or availability impact. The scope is limited to the affected WordPress installation, and the attacker cannot directly read sensitive data or crash the service. However, depending on the plugin's functionality (managing order terms/conditions), an attacker could manipulate plugin settings or data without the victim's consent (Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-66097. The EPSS score is approximately 0.015% (0.000150), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

1. Reconnaissance: Identify WordPress sites running the I Order Terms plugin (version ≤ 1.5.0) via plugin enumeration techniques (e.g., checking /wp-content/plugins/i-order-terms/ path or using tools like WPScan).
2. Craft malicious request: Identify the specific plugin action endpoint (e.g., an admin-facing form or AJAX action) that performs a state-changing operation without CSRF token validation.
3. Create CSRF payload: Build a malicious HTML page containing a hidden form or JavaScript that automatically submits a forged request to the target WordPress site's plugin endpoint, mimicking a legitimate administrator action.
4. Deliver to victim: Trick an authenticated WordPress administrator into visiting the malicious page via phishing email, social engineering, or a compromised third-party site.
5. Achieve objective: The victim's browser automatically submits the forged request with their session credentials, causing the plugin to execute the unauthorized action (e.g., modifying order terms settings) on the attacker's behalf (Feedly).

Users should update the I Order Terms WordPress plugin to a version beyond 1.5.0 if a patched release is available from the plugin author Igor Jerosimić. If no patch is yet available, administrators should consider deactivating and removing the plugin until a fix is released. As a general defense-in-depth measure, WordPress administrators should avoid clicking on untrusted links while logged into their admin panel, and consider using a web application firewall (WAF) capable of detecting CSRF attempts (Patchstack).