What is the CVSS score of CVE-2025-66058?

CVE-2025-66058 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-66058

MEDIUM

Missing Authorization (CWE-862)

2025-12-18 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

6.5 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 18, 2025 - 17:15 nvd

N/A

DescriptionCVE.org

Missing Authorization vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Grid and Gutenberg Blocks: from n/a through <= 2.3.17.

AnalysisAI

Missing authorization in PickPlugins Post Grid and Gutenberg Blocks WordPress plugin (versions through 2.3.17) allows attackers to bypass access control restrictions and exploit incorrectly configured security levels, potentially enabling unauthorized access to protected content or administrative functions. The vulnerability stems from broken access control (CWE-862) with no public exploit code confirmed at time of analysis, though EPSS scoring of 0.04% suggests minimal real-world exploitation probability despite the authorization flaw.

Technical ContextAI

The vulnerability is classified as CWE-862 (Missing Authorization), which indicates the plugin fails to properly enforce access control checks before performing sensitive operations. This is a common WordPress plugin vulnerability pattern where capability checks or nonce validation are either missing or improperly implemented in REST API endpoints, AJAX handlers, or direct function calls. The Post Grid plugin processes user-supplied input related to grid configuration and content filtering without adequate authorization verification, allowing attackers to manipulate access control security levels. The affected product is a Gutenberg-compatible WordPress plugin used for displaying posts in customizable grid layouts.

Affected ProductsAI

PickPlugins Post Grid and Gutenberg Blocks WordPress plugin versions up to and including 2.3.17. The plugin is distributed through WordPress.org plugin repository and is identified by the slug 'post-grid'. No specific WordPress version restrictions are documented, indicating the vulnerability affects all WordPress installations using the vulnerable plugin versions.

RemediationAI

Update PickPlugins Post Grid and Gutenberg Blocks to a patched version released after 2.3.17 immediately. Check the plugin's WordPress.org page or the vendor advisory at https://patchstack.com/database/Wordpress/Plugin/post-grid/vulnerability/wordpress-post-grid-and-gutenberg-blocks-plugin-2-3-17-broken-access-control-vulnerability-2 for the specific patched version number. If an immediate update is unavailable, consider temporarily disabling the plugin on production sites handling sensitive content until a patch is confirmed released and tested in a staging environment.