CVE-2025-67580: 
WordPress vulnerability analysis and mitigation

CVE-2025-67580 is a Missing Authorization vulnerability in the Constant Contact + WooCommerce WordPress plugin that allows unauthenticated attackers to exploit incorrectly configured access control security levels. It affects all versions of the plugin from n/a through 2.4.1. The vulnerability was published on December 9, 2025, and was assigned by Patchstack. It carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before performing certain actions. Because no authentication or privilege check is enforced on the affected functionality, a remote, unauthenticated attacker can interact with restricted plugin features over the network with low attack complexity. No user interaction is required to trigger the vulnerability (Feedly).

Successful exploitation results in a low-level integrity impact, allowing unauthenticated attackers to perform unauthorized actions within the plugin's scope on affected WordPress/WooCommerce installations. Confidentiality and availability are not directly impacted according to the CVSS scoring. The vulnerability's network-accessible attack vector means any internet-facing WordPress site running the affected plugin version is potentially at risk (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-67580 at this time. The EPSS score is approximately 0.04%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

Users should update the Constant Contact + WooCommerce WordPress plugin to a version beyond 2.4.1 as soon as a patched release becomes available from the vendor. In the interim, site administrators should consider disabling the plugin if it is not critical to operations, or restrict access to the WordPress admin and plugin endpoints via web application firewall (WAF) rules. Monitoring plugin activity logs for unexpected or unauthorized actions is also advisable (Patchstack).