CVE-2025-66150: 
WordPress vulnerability analysis and mitigation

CVE-2025-66150 is a Missing Authorization (Broken Access Control) vulnerability in the merkulove Appender WordPress plugin that allows authenticated low-privileged attackers to exploit incorrectly configured access control security levels. It affects all versions of the Appender plugin through 1.1.1. The vulnerability was disclosed on December 31, 2025, with the CVE assigned by Patchstack. It carries a CVSS v3.1 base score of 5.4 (Medium) (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before allowing access to certain functionality. An attacker with a low-privileged WordPress account (e.g., subscriber or contributor) can send crafted network requests to plugin endpoints that lack proper capability checks, thereby performing actions that should be restricted to higher-privileged roles. The attack requires network access and low-level authentication but no user interaction, and the scope remains unchanged (Patchstack, Red Hat CVE).

Successful exploitation allows a low-privileged authenticated attacker to modify or disable application functionality within the affected WordPress site, impacting both integrity and availability. Confidentiality is not directly affected according to the CVSS assessment. The impact is limited to the scope of the vulnerable plugin's functionality, with no evidence of lateral movement potential beyond the WordPress installation (Patchstack, Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-66150. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.036%, indicating a very low probability of exploitation in the near term (Red Hat CVE).

WordPress site administrators should update the merkulove Appender plugin to a version beyond 1.1.1 if a patched release is available. If no patched version is yet available, the recommended workaround is to deactivate and remove the plugin until a fix is released. Access to the WordPress admin panel should be restricted to trusted users, and the principle of least privilege should be enforced for all WordPress user roles (Patchstack).