What is the CVSS score of CVE-2025-66527?

CVE-2025-66527 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Lobo CVE-2025-66527

Q: Which versions of Lobo are affected by CVE-2025-66527?

Authenticated low-privilege users can exploit missing authorization in the VanKarWai Lobo WordPress theme through version 2.8.6, resulting in low-availability impact via broken access control.

MEDIUM

Missing Authorization (CWE-862)

2025-12-09 audit@patchstack.com

WordPress Authentication Bypass Wordpress Theme

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

4.3 MEDIUM

Network attack, low complexity, low privileges, only availability impact per Patchstack advisory.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 17:44 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in VanKarWai Lobo lobo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lobo: from n/a through <= 2.8.6.

AnalysisAI

Authenticated low-privilege users can exploit missing authorization in the VanKarWai Lobo WordPress theme through version 2.8.6, resulting in low-availability impact via broken access control. No public exploit or active exploitation has been reported; EPSS probability is very low (0.05%).

Technical ContextAI

The vulnerability resides in the Lobo WordPress theme, a PHP-based component that extends site functionality. It is classified under CWE-862 (Missing Authorization) and involves incorrectly configured access control security levels, likely within a theme-provided AJAX handler or REST API endpoint. The flaw permits an authenticated user with limited privileges to perform an action that should be restricted, leading to a denial-of-service condition (availability impact). The affected product is not identified by a specific CPE string in the NVD, but the Patchstack reference confirms the theme's name and version range.

Affected ProductsAI

VanKarWai Lobo WordPress theme, all versions up to and including 2.8.6. Reference: Patchstack vulnerability database entry for the Lobo theme (https://patchstack.com/database/Wordpress/Theme/lobo/vulnerability/wordpress-lobo-theme-2-8-6-broken-access-control-vulnerability?_s_id=cve).

RemediationAI

No officially patched version is confirmed; the Patchstack advisory does not list a fixed release. Users should immediately update to the latest available version of Lobo from the theme vendor’s trustnedsource. If no update exists, consider disabling the theme and switching to a maintained alternative. As a compensating control, limit or remove low-privileged user accounts that do not require theme interaction, and monitor for associated Patchstack or vendor announcements for a patch.