CVE-2025-66121: 
WordPress vulnerability analysis and mitigation

CVE-2025-66121 is a Missing Authorization (Broken Access Control) vulnerability in the SiteGround Security WordPress plugin (sg-security). It affects all versions from the beginning through version 1.5.8, allowing unauthenticated network-based attackers to exploit incorrectly configured access control security levels. The vulnerability was disclosed on December 16, 2025, by Patchstack, which serves as the CVE Numbering Authority (CNA) for this entry. It carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before performing certain actions. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote attacker. The specific functionality lacking authorization checks has not been publicly detailed in available sources, but the vulnerability class typically involves unauthenticated or low-privileged users invoking plugin endpoints or AJAX handlers that should be restricted to administrators (Patchstack).

Exploitation of this vulnerability results in a limited availability impact (CVSS A:L), with no confidentiality or integrity impact according to the Patchstack-assigned CVSS vector. An unauthenticated attacker could abuse the missing authorization checks to trigger certain plugin actions, potentially disrupting security features managed by the SiteGround Security plugin on affected WordPress sites. The scope is limited to the affected system and does not facilitate lateral movement or sensitive data exposure based on currently available information (Patchstack).

There is no public evidence of active in-the-wild exploitation or weaponized exploit code for CVE-2025-66121 at this time. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Patchstack).

Users should update the SiteGround Security plugin (sg-security) to a version beyond 1.5.8 that addresses this authorization flaw. WordPress site administrators can update the plugin directly from the WordPress admin dashboard under Plugins > Installed Plugins. No specific workaround has been published; upgrading to the patched version is the recommended remediation (Patchstack).