Wordpress Plugin CVE-2025-66088

HIGH

Missing Authorization (CWE-862)

2025-12-18 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

7.5

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

2

Analysis Generated

Jul 26, 2026 - 16:36 vuln.today

CVE Published

Dec 18, 2025 - 08:16 cve.org

HIGH 7.5

DescriptionCVE.org

Missing Authorization vulnerability in Property Hive PropertyHive propertyhive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PropertyHive: from n/a through <= 2.1.12.

AnalysisAI

Unauthenticated information disclosure in PropertyHive plugin (≤2.1.12) allows remote attackers to access sensitive property data without authentication. The vulnerability stems from missing authorization checks on certain endpoints, effectively bypassing access controls. No active exploitation or public exploit code has been identified; EPSS score is very low.

More in Wordpress Plugin

View all

CVE-2023-6553 CRITICAL Act Now POC

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1

CVE-2024-5084 CRITICAL Act Now POC

The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil

CVE-2024-44000 CRITICAL Emergency POC

Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote

CVE-2020-36847 CRITICAL Act Now POC

The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner

CVE-2025-27007 CRITICAL Emergency POC

The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut

CVE-2016-1209 CRITICAL Emergency POC

The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via

CVE-2024-4443 CRITICAL Act Now POC

The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based

CVE-2024-1698 CRITICAL Act Now POC

SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a

CVE-2023-6875 CRITICAL Emergency POC

The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i

CVE-2024-1512 CRITICAL Emergency POC

The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base

CVE-2024-4295 CRITICAL Act Now POC

The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in

CVE-2024-50498 CRITICAL Emergency POC

Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u

Same weakness CWE-862 – Missing Authorization

View all

CVE-2023-52163 HIGH POC

CVE-2025-6205 CRITICAL POC

CVE-2025-20362 HIGH POC

CVE-2017-9232 CRITICAL POC

CVE-2023-6875 CRITICAL POC

CVE-2024-4898 CRITICAL POC

CVE-2023-32117 CRITICAL POC

CVE-2020-36719 CRITICAL POC

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

CVE-2012-4681 CRITICAL POC

CVE-2013-2465 CRITICAL POC

CVE-2011-3544 CRITICAL POC

CVE-2022-40684 CRITICAL POC

CVE-2025-61882 CRITICAL POC

CVE-2024-0012 CRITICAL POC

CVE-2023-46805 HIGH POC

Share

CVE-2025-66088 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy