CVE-2025-66532: 
WordPress vulnerability analysis and mitigation

CVE-2025-66532 is a Missing Authorization (Broken Access Control) vulnerability in the Mikado-Themes Powerlift WordPress theme that allows low-privileged authenticated attackers to exploit incorrectly configured access control security levels. It affects all versions of the Powerlift theme prior to 3.2.1. The vulnerability was reported on October 28, 2025, by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) and published on November 27, 2025. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the theme fails to perform adequate authorization checks — such as capability checks or nonce token validation — before executing privileged actions. This allows a low-privileged user (e.g., a Subscriber-level account) to invoke functionality that should be restricted to higher-privileged roles. The attack vector is network-based, requires low privileges, and no user interaction, making it straightforward to exploit for any authenticated user on the affected WordPress site (Patchstack).

Successful exploitation allows a low-privileged authenticated attacker to perform actions beyond their intended authorization level, resulting in a low integrity impact (unauthorized data modification). Confidentiality and availability are not directly impacted according to the CVSS assessment. The scope is limited to the affected WordPress installation, but unauthorized modification of theme settings or site content could degrade site integrity (Patchstack).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack rates this as low priority, noting it is unlikely to be exploited (Patchstack).

The vendor has released a patched version of the Powerlift WordPress theme. Users should update to version 3.2.1 or later immediately. If an immediate update is not possible, site administrators should restrict user registration and limit Subscriber-level access, and consult their hosting provider or web developer for assistance. Reviewing and auditing access control configurations within the theme is also recommended (Patchstack).