CVE-2025-66149: 
WordPress vulnerability analysis and mitigation

CVE-2025-66149 is a Missing Authorization (Broken Access Control) vulnerability in the merkulove UnGrabber WordPress plugin that allows authenticated low-privileged attackers to exploit incorrectly configured access control security levels. It affects UnGrabber versions up to and including 3.1.3. The CVE was published on December 31, 2025, and assigned by Patchstack. It carries a CVSS v3.1 base score of 5.4 (Medium) (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before allowing access to certain functionality. An attacker with a low-privileged WordPress account (e.g., subscriber or contributor) can send network requests to restricted plugin endpoints without proper authorization checks, enabling unauthorized actions. No user interaction is required, and attack complexity is low, making it straightforward to exploit for any authenticated user on the affected WordPress site (Patchstack, Red Hat CVE).

Successful exploitation allows a low-privileged authenticated attacker to perform unauthorized modifications to plugin data and potentially disrupt plugin availability, resulting in limited integrity and availability impacts. Confidentiality is not directly affected according to the CVSS assessment (C:N). The scope is limited to the affected WordPress installation, but could disrupt site functionality or content managed by the UnGrabber plugin (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-66149. The EPSS score is approximately 0.036%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid (low-privileged) account on the target WordPress site, which limits the attacker pool (Red Hat CVE, Feedly).

1. Reconnaissance: Identify WordPress sites running the UnGrabber plugin (version ≤ 3.1.3) using tools like WPScan or by inspecting plugin directories.
2. Authentication: Obtain or register a low-privileged WordPress account (e.g., subscriber role) on the target site.
3. Identify unprotected endpoints: Enumerate plugin-specific AJAX actions or REST API endpoints registered by UnGrabber that lack proper capability checks.
4. Send unauthorized request: Craft and send an authenticated HTTP request (e.g., via admin-ajax.php with the relevant action parameter) to the unprotected endpoint, bypassing the intended access control.
5. Achieve unauthorized action: Successfully modify or disable plugin data/settings that should be restricted to higher-privileged users, impacting site integrity or availability (Patchstack).

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/admin-ajax.php with UnGrabber-specific action parameters from low-privileged user accounts; unexpected changes to plugin settings recorded in WordPress activity logs.
• File System: Unexpected modifications to UnGrabber plugin configuration or data files.
• Application: Unexplained changes to UnGrabber plugin settings or content by users who should not have administrative access.

WordPress site administrators should update the UnGrabber plugin to a version beyond 3.1.3 if a patched release becomes available from the merkulove vendor. In the interim, disabling the UnGrabber plugin is the most effective workaround to eliminate the attack surface. Restricting site registration and limiting the number of low-privileged accounts can also reduce exposure. Monitor the Patchstack database and the WordPress plugin repository for an updated, patched release (Patchstack).