CVE-2025-66131: 
WordPress vulnerability analysis and mitigation

CVE-2025-66131 is a Missing Authorization vulnerability in the Yaad Sarig Payment Gateway For WC WordPress plugin that allows unauthenticated attackers to exploit incorrectly configured access control security levels. It affects all versions of the plugin through 2.2.11 (initially reported as through 2.2.10, later updated to include 2.2.11). The vulnerability was disclosed on December 16, 2025, and was reported by Patchstack. The CNA (Patchstack) assigned a CVSS v3.1 base score of 5.3 (Medium), though an earlier CISA-ADP assessment had initially scored it 9.1 (Critical) before being removed (NVD, Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify that a requesting user has the necessary permissions before granting access to sensitive functionality. This allows unauthenticated network-based attackers to interact with restricted plugin endpoints without any credentials or user interaction required. The attack complexity is low, requiring no special conditions or privileges. The specific vulnerable code paths within the payment gateway plugin have not been publicly detailed beyond the access control misconfiguration (NVD, Patchstack).

Successful exploitation could allow an unauthenticated attacker to access sensitive payment gateway functionality and data, potentially leading to unauthorized information disclosure or data manipulation within the WooCommerce payment processing context. The Patchstack CNA assessment indicates a limited availability impact (CVSS A:L) with no confidentiality or integrity impact in its revised scoring, suggesting the primary risk is disruption to plugin functionality rather than full data compromise. However, given the payment gateway context, any unauthorized access to transaction-related endpoints could have significant business implications for affected WordPress/WooCommerce sites (NVD, Patchstack).

There is no public proof-of-concept exploit code available, and no evidence of in-the-wild exploitation has been reported. The EPSS score is very low at 0.017%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been made (NVD).

Users should immediately update the Yaad Sarig Payment Gateway For WC plugin to a version newer than 2.2.11, as a patch has been made available by the vendor. In addition to patching, administrators should review WordPress user roles and access controls, audit recent access logs for any unauthorized requests to payment gateway endpoints, and implement monitoring for unusual plugin activity. No specific configuration-based workaround has been published as an alternative to patching (NVD, Patchstack).