What is the CVSS score of CVE-2025-66525?

CVE-2025-66525 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Elastic Email Sender CVE-2025-66525

MEDIUM

Missing Authorization (CWE-862)

2025-12-09 audit@patchstack.com

WordPress Authentication Bypass Elastic Wordpress Plugin

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

4.3 MEDIUM

Low‑privilege authenticated user needed, no user interaction, only availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 17:44 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in Elastic Email Elastic Email Sender elastic-email-sender allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elastic Email Sender: from n/a through <= 1.2.20.

AnalysisAI

An authenticated low-privilege user on WordPress can exploit missing authorization checks in Elastic Email Sender plugin up to version 1.2.20 to cause availability disruption, such as disabling email sending functionality. This vulnerability, reported by Patchstack, carries a medium CVSS 4.3 but extremely low EPSS probability of exploitation, and no evidence of active exploitation exists.

Technical ContextAI

The vulnerability is a Missing Authorization (CWE-862) issue in the WordPress plugin “elastic-email-sender” by Elastic Email. Incorrectly configured access control security levels allow unauthorized users to perform actions that should be restricted to higher capabilities. The underlying technology is PHP within the WordPress CMS, and the flaw likely resides in an AJAX handler or admin-page callback that lacks proper capability checks (e.g., current_user_can). The CVSS vector indicates that an authenticated attacker with low privileges can trigger the flaw over the network with low attack complexity and no user interaction, affecting only availability.

Affected ProductsAI

The Elastic Email Sender plugin for WordPress, all versions from n/a through 1.2.20, as listed in the Patchstack database (no CPE string provided). See advisory: https://patchstack.com/database/Wordpress/Plugin/elastic-email-sender/vulnerability/wordpress-elastic-email-sender-plugin-1-2-20-broken-access-control-vulnerability?_s_id=cve

RemediationAI

No vendor‑released patch has been confirmed at the time of this analysis. Until a fix is available, apply the following compensating controls: restrict user roles - remove unnecessary low‑privilege accounts (e.g., subscribers) or revoke their access to plugin-specific endpoints via WordPress capability management; or temporarily disable the Elastic Email Sender plugin. Caution: disabling the plugin will halt all email sending through the Elastic Email service, which may break critical workflows. Monitor the Patchstack advisory for an upstream fix.