What is the CVSS score of CVE-2025-66076?

CVE-2025-66076 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Woostify Sites Library CVE-2025-66076

EUVD-2025-210399 MEDIUM

Missing Authorization (CWE-862)

2026-07-02 Patchstack

GHSA-9j9h-m3wq-x944

Authentication Bypass Woostify Sites Library

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable with no authentication (AV:N, PR:N) per broken access control; impact is integrity-only (I:L) with no confidentiality or availability impact described.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:38 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Woostify Sites Library <= 1.6.2 versions.

AnalysisAI

Unauthenticated broken access control in Woostify Sites Library WordPress plugin versions up to and including 1.6.2 permits remote, unauthenticated attackers to bypass authorization checks and perform restricted actions against affected WordPress installations. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials and no user interaction, making automated scanning and exploitation straightforward. No active exploitation has been identified at time of analysis, and no public exploit code is known.

Technical ContextAI

Woostify Sites Library is a WordPress plugin developed by Dylan Ngo (CPE: cpe:2.3:a:dylan_ngo:woostify_sites_library:*:*:*:*:*:*:*:*), designed to provide a library of pre-built site templates for the Woostify WordPress theme. The root cause is CWE-862 (Missing Authorization), a class of vulnerability where plugin-registered AJAX handlers or REST API endpoints fail to perform proper capability checks - typically a missing or bypassed call to WordPress's current_user_can() function - before executing privileged operations. This allows any unauthenticated HTTP request to trigger functionality that should be restricted to authenticated administrators or editors, such as importing site templates or modifying plugin-controlled settings.

RemediationAI

Upgrade Woostify Sites Library to a version beyond 1.6.2 once a patched release is published by the developer or made available through the WordPress plugin repository. No exact patched version number is confirmed from available data - monitor the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/woostify-sites-library/vulnerability/wordpress-woostify-sites-library-plugin-1-6-2-broken-access-control-vulnerability for patch release confirmation. If no patch is yet available, deactivate the plugin until a fix is issued, as this eliminates the attack surface entirely with the trade-off of losing site library functionality. As a secondary control, deploy a WAF rule to block unauthenticated requests to WordPress AJAX (wp-admin/admin-ajax.php) or REST API endpoints registered by this plugin, though identifying the exact endpoint requires further investigation of the plugin source code.