CVE-2025-66100: 
WordPress vulnerability analysis and mitigation

CVE-2025-66100 is a Missing Authorization (Broken Access Control) vulnerability in the RestroPress WordPress plugin developed by MagniGenie. It allows authenticated attackers with low-level privileges to exploit incorrectly configured access control security levels, potentially exposing sensitive information. The vulnerability affects RestroPress versions up to and including 3.2.3.5. It was published on December 18, 2025, and carries a CVSS v3.1 base score of 6.5 (Medium) (Feedly, EUVD).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify that an authenticated user has the appropriate permissions before granting access to certain functionality or data. The attack vector is network-based, requires low privileges (a valid WordPress account), no user interaction, and low attack complexity. The vulnerability was discovered and reported by Patchstack, which assigned it under their vulnerability disclosure program (Feedly, EUVD).

Successful exploitation results in a high confidentiality impact, as attackers can access data or functionality beyond their intended authorization level within the RestroPress plugin (a food ordering/restaurant management plugin for WordPress). There is no direct integrity or availability impact based on the CVSS scoring. The scope is limited to the affected WordPress installation, but sensitive order data, customer information, or plugin configuration details could be exposed to unauthorized authenticated users (Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-66100. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

Users of the RestroPress WordPress plugin should update to a version beyond 3.2.3.5 if a patched release is available from MagniGenie. If no patch is yet available, site administrators should consider deactivating the plugin until a fix is released, or restricting access to WordPress authenticated roles to trusted users only. Monitoring WordPress user activity logs for unexpected access to RestroPress-related endpoints may help detect abuse (Feedly, EUVD).

The vulnerability received routine automated coverage across vulnerability aggregation platforms (Vulners, CVEFeed, VulDB) and a brief mention on Bluesky's CVE feed shortly after disclosure. No notable researcher commentary, vendor statements beyond the Patchstack advisory, or significant media coverage has been identified (Feedly).