CVE-2025-66525: 
WordPress vulnerability analysis and mitigation

CVE-2025-66525 is a Missing Authorization (Broken Access Control) vulnerability in the Elastic Email Sender WordPress plugin affecting all versions up to and including 1.2.20. The flaw allows authenticated attackers with low privileges (Subscriber level) to perform actions beyond their intended authorization level. It was reported by researcher Legion Hunter on September 28, 2025, published by Patchstack on October 28, 2025, and assigned a CVE on December 9, 2025. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks — such as capability checks or nonce token validation — before executing privileged functions. This allows a low-privileged authenticated user (e.g., a Subscriber) to invoke functionality intended for higher-privileged roles. The attack vector is network-based, requires low privileges, no user interaction, and low attack complexity (Patchstack).

Successful exploitation results in a limited integrity impact, allowing an authenticated low-privileged user to perform unauthorized actions within the plugin's functionality. There is no direct confidentiality or availability impact based on the CVSS assessment. While the individual impact is low, Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites simultaneously, regardless of site size or popularity (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with no impactful threat, though it notes the vulnerability class is used in mass-exploit campaigns (Patchstack).

The vulnerability is patched in Elastic Email Sender version 1.2.21. WordPress site administrators should update the plugin to version 1.2.21 or later immediately. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, site owners should contact their hosting provider or web developer for assistance (Patchstack).