CVE-2025-67599: 
WordPress vulnerability analysis and mitigation

CVE-2025-67599 is a Missing Authorization vulnerability in the WebToffee eCommerce Marketing Automation WordPress plugin (also known as decorator-woocommerce-email-customizer) that allows authenticated attackers with low privileges to exploit incorrectly configured access control security levels. The vulnerability affects all versions of the plugin up to and including 2.1.1. It was published on December 9, 2025, with Patchstack credited as the assigner. The CVSS v3.1 base score is 4.3 (Medium) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify that a requesting user has the necessary permissions before granting access to certain functionality. The attack vector is network-based, requires low privileges (an authenticated user account), and no user interaction, with low attack complexity. The vulnerability falls under the broader category of broken access control, where restricted plugin features or data can be accessed by users who should not have permission to do so (Feedly).

Successful exploitation results in a low confidentiality impact — authenticated low-privileged users (e.g., subscribers or customers on a WooCommerce store) may be able to access information or functionality that should be restricted to higher-privileged roles such as administrators. There is no integrity or availability impact identified. The scope is limited to the affected WordPress installation and does not extend to other systems (Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-67599. The EPSS score is approximately 0.032%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid low-privileged account on the target WordPress site, limiting opportunistic mass exploitation (Feedly).

Users should update the WebToffee eCommerce Marketing Automation plugin to a version beyond 2.1.1 that addresses this access control issue. Until a patched version is available or applied, site administrators should consider restricting plugin access, auditing user roles and capabilities on the WordPress site, and monitoring for unexpected access to plugin-related endpoints. Disabling the plugin temporarily is a viable workaround if the update cannot be applied immediately (Feedly, Patchstack).