CVE-2025-66127: 
WordPress vulnerability analysis and mitigation

CVE-2025-66127 is a Missing Authorization vulnerability in the Essential Real Estate WordPress plugin developed by g5theme. It allows attackers to exploit incorrectly configured access control security levels (CWE-862). The vulnerability was first disclosed on December 16, 2025, by Patchstack, and the affected version range has been updated over time — currently confirmed through version 5.3.2 and earlier. The CVSS 3.1 base score assigned by Patchstack is 5.3 (Medium), reflecting a network-accessible, unauthenticated attack vector with limited confidentiality impact (NVD, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before performing sensitive operations. The attack vector is network-based with low attack complexity and no required user interaction, making it accessible to unauthenticated or low-privileged remote attackers. The vulnerability stems from incorrectly configured access control security levels within the plugin's functionality, allowing unauthorized actors to invoke restricted plugin actions or endpoints. No detailed public technical write-up or proof-of-concept code has been published as of the available data (NVD, Patchstack).

Successful exploitation results in limited but meaningful unauthorized access: attackers can read restricted data (low confidentiality impact) without causing availability disruption. The updated CVSS vector from Patchstack (PR:N) indicates unauthenticated attackers may access information that should be restricted, such as internal listing data, user details, or plugin configuration. While the impact is not critical, exposure of sensitive real estate or user data on affected WordPress sites could facilitate further targeted attacks or privacy violations (NVD).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-66127. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The CVE was assigned and disclosed by Patchstack, which tracks WordPress plugin vulnerabilities (NVD, Patchstack).

Users of the Essential Real Estate WordPress plugin by g5theme should update to a version above 5.3.2 as soon as a patched release is made available by the vendor. Site administrators should monitor the official WordPress plugin repository and the Patchstack advisory for patch availability. In the interim, consider restricting access to the WordPress admin panel and plugin endpoints via firewall rules or web application firewall (WAF) rules. Disabling the plugin until a fix is confirmed is a viable precautionary measure for high-risk environments (NVD, Patchstack).