CVE-2025-66132: 
WordPress vulnerability analysis and mitigation

CVE-2025-66132 is an Authorization Bypass Through User-Controlled Key (IDOR) vulnerability in the FAPI Member WordPress plugin developed by FAPI Business s.r.o. The vulnerability allows unauthenticated remote attackers to exploit incorrectly configured access control security levels to gain unauthorized access to restricted content. It affects FAPI Member versions up to and including 2.2.30, with the affected version range updated multiple times since initial disclosure. First received by NVD on December 16, 2025, and last modified April 27, 2026, it carries a CVSS v3.1 base score of 5.3 (Medium), assigned by Patchstack (NVD).

The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), commonly known as an Insecure Direct Object Reference (IDOR). The flaw arises when the plugin uses user-supplied input — such as an object identifier — to directly reference protected resources without adequately verifying that the requesting user is authorized to access them. No authentication or special privileges are required to exploit this vulnerability, and it can be triggered remotely over the network with low attack complexity and no user interaction required (NVD, Patchstack).

Successful exploitation results in unauthorized read access to information that should be restricted by the plugin's membership access control system, such as premium or members-only content on WordPress sites using FAPI Member. The confidentiality impact is rated low, with no integrity or availability impact. Affected sites may expose paid or gated content to unauthenticated users, undermining the plugin's core membership management functionality (NVD).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-66132. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The low attack complexity and lack of authentication requirements make it theoretically accessible to a wide range of attackers, though the limited impact scope reduces its attractiveness as a target (NVD).

1. Reconnaissance: Identify WordPress sites using the FAPI Member plugin (version ≤ 2.2.30) via HTTP response headers, plugin directory enumeration, or tools like WPScan.
2. Identify protected resources: Browse the target site to identify membership-gated content, noting the object identifiers (e.g., post IDs, page IDs, or membership level keys) used in URLs or request parameters.
3. Manipulate user-controlled key: Craft HTTP requests that directly reference protected resource identifiers (e.g., modifying a post ID or membership key in a GET/POST parameter) without providing valid membership credentials.
4. Access restricted content: Submit the crafted request to the server; due to the missing or insufficient authorization check, the plugin returns the protected content to the unauthenticated requester (NVD, Patchstack).

• Network: Unusual unauthenticated HTTP GET/POST requests to FAPI Member plugin endpoints with manipulated object identifiers (e.g., post IDs or membership keys) in URL parameters or request bodies.
• Logs: WordPress access logs showing repeated requests to membership-protected content URLs from unauthenticated sessions (no valid session cookie or nonce); patterns of sequential or enumerated resource ID values in request parameters.
• File System: No file system artifacts expected for this read-only IDOR vulnerability; no file writes or uploads are involved.

Users should update the FAPI Member WordPress plugin to a version beyond 2.2.30, which is the last confirmed vulnerable version. Site administrators should monitor the official WordPress plugin repository or the vendor's release notes for a patched release. As a temporary workaround, restricting access to membership-gated content via server-level controls (e.g., IP allowlisting or WAF rules targeting suspicious parameter enumeration) may reduce exposure until a patch is applied (NVD, Patchstack).