CVE-2025-66108: 
WordPress vulnerability analysis and mitigation

CVE-2025-66108 is a Missing Authorization vulnerability in the TNC Toolbox: Web Performance WordPress plugin developed by Merlot Digital (by TNC). The flaw allows authenticated attackers with low privileges to exploit incorrectly configured access control security levels. All versions up to and including 2.0.4 are affected. It was published on November 21, 2025, and carries a CVSS v3.1 base score of 4.3 (Medium) (Feedly, ENISA EUVD).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify that a requesting user has the necessary permissions before performing sensitive operations. An authenticated attacker with low-level privileges (e.g., a subscriber-level WordPress account) can send crafted network requests to trigger restricted functionality without proper authorization checks. No user interaction is required, and the attack complexity is low, making it straightforward to exploit once authenticated (Feedly, ENISA EUVD).

Successful exploitation results in limited unauthorized access to sensitive information, as the vulnerability has a low confidentiality impact with no integrity or availability impact. An attacker with a low-privileged WordPress account could access data or functionality that should be restricted to higher-privileged roles. The scope is unchanged, meaning the impact is confined to the vulnerable plugin's context and does not directly enable lateral movement or full system compromise (Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-66108. The EPSS score is approximately 0.022% (0.000220), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was assigned and disclosed by Patchstack (Feedly, ENISA EUVD).

WordPress site administrators should update the TNC Toolbox: Web Performance plugin to a version beyond 2.0.4 if a patched release is available from the plugin vendor, Merlot Digital (by TNC). If no patched version is yet available, the recommended workaround is to deactivate and remove the plugin until a fix is released. Restricting untrusted user registrations on the WordPress site can also reduce the attack surface, as exploitation requires at least a low-privileged authenticated account (Feedly, ENISA EUVD).

Wordfence included CVE-2025-66108 in its weekly WordPress vulnerability report covering November 24–30, 2025, noting it as part of a broader set of access control issues affecting WordPress plugins (Wordfence Blog). No significant independent researcher commentary or broader media coverage has been identified for this vulnerability.