CVE-2025-66130: 
WordPress vulnerability analysis and mitigation

CVE-2025-66130 is a Missing Authorization (Broken Access Control) vulnerability in the WP Views Counter WordPress plugin developed by etruel. It allows unauthenticated remote attackers to exploit incorrectly configured access control security levels, potentially modifying data without proper authorization. The vulnerability affects all versions of WP Views Counter from n/a through 2.1.2 (inclusive). It was published on December 16, 2025, by Patchstack, and carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to verify whether a requesting user has the appropriate permissions before executing sensitive actions. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity — making it trivially exploitable by any remote actor. The specific plugin functionality lacking authorization checks relates to view counter operations (plugin slug: wpecounter), which can be manipulated without privilege. No public technical write-up or proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation results in a low integrity impact — an unauthenticated attacker can manipulate view counter data on affected WordPress sites without authorization. There is no confidentiality or availability impact reported. While the direct impact is limited to data integrity (e.g., artificially inflating or resetting view counts), it could be leveraged to distort site analytics or content popularity metrics (Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-66130. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified.

Users of the WP Views Counter plugin should update to a version beyond 2.1.2 if a patched release is available from the plugin developer (etruel). If no patch is yet available, the recommended workaround is to deactivate and remove the plugin until a fix is released. WordPress site administrators should also review access logs for unexpected requests to plugin-specific endpoints and ensure their WordPress installation and all plugins are kept up to date (Patchstack).