CVE-2025-66122: 
WordPress vulnerability analysis and mitigation

CVE-2025-66122 is a Missing Authorization (Broken Access Control) vulnerability in the Stylish Price List WordPress plugin by Design Stylish Price List. It affects all versions through 7.2.2 and allows authenticated attackers with low privileges to exploit incorrectly configured access control security levels. The vulnerability was published on December 16, 2025, and assigned by Patchstack. The CVSS v3.1 base score is 5.3 (Medium) per the CNA (Patchstack) assessment (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing sensitive actions. This allows a low-privileged authenticated user to perform operations that should be restricted to higher-privilege roles (e.g., administrators). The attack vector is network-based, requires no user interaction, and has low attack complexity, making it straightforward to exploit once an attacker has any valid WordPress account (Patchstack).

Successful exploitation results in limited but meaningful unauthorized access: an attacker with a low-privilege WordPress account (e.g., subscriber) can perform actions on price list data that should be restricted to higher-privileged users, leading to low-level confidentiality and integrity impacts. Availability is not affected. The scope is limited to the affected WordPress installation, with no direct path to lateral movement or full system compromise based on available information (Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-66122. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

WordPress site administrators should update the Stylish Price List plugin to a version beyond 7.2.2 if a patched release is available from the plugin author. If no patch is yet available, the recommended workaround is to deactivate and remove the plugin until a fix is released. Access to WordPress sites should be restricted to trusted users, and the principle of least privilege should be enforced to reduce the risk of exploitation by low-privilege accounts (Patchstack).

The vulnerability was reported and assigned by Patchstack, a WordPress security firm that operates a vulnerability disclosure program. No notable researcher commentary, media coverage, or significant community discussion beyond the initial disclosure has been identified for this CVE.