What is the CVSS score of CVE-2025-66534?

CVE-2025-66534 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

The Aisle CVE-2025-66534

Q: Which versions of The Aisle are affected by CVE-2025-66534?

Missing authorization in Elated-Themes The Aisle WordPress theme version 2.9 and below allows authenticated low-privilege users to modify data without proper permission checks.

MEDIUM

Missing Authorization (CWE-862)

2025-12-09 audit@patchstack.com

WordPress Authentication Bypass Wordpress Theme

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Requires low-privilege access (PR:L); network exploitable; integrity impact only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 17:42 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in Elated-Themes The Aisle theaisle allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Aisle: from n/a through <= 2.9.

AnalysisAI

Missing authorization in Elated-Themes The Aisle WordPress theme version 2.9 and below allows authenticated low-privilege users to modify data without proper permission checks. The vulnerability, rated Medium (CVSS 4.3), requires a valid user account but no other preconditions; it has a low EPSS score (0.07%) and is not known to be actively exploited.

Technical ContextAI

The Aisle is a WordPress theme. The vulnerability is a Missing Authorization (CWE-862) flaw, meaning a function endpoint intended for specific roles lacks adequate access controls. This class of issue arises when a plugin or theme registers an AJAX or REST endpoint without verifying the user’s capabilities, enabling unwanted data modification. The CPE string implied by the product and vendor is cpe:2.3:a:elated-themes:the_aisle:2.9:*:*:*:*:wordpress:*:*.

Affected ProductsAI

The Aisle WordPress theme, all versions up to and including 2.9. This is a theme sold by Elated-Themes; further details are available in the Patchstack database entry at https://patchstack.com/database/Wordpress/Theme/theaisle/vulnerability/wordpress-the-aisle-theme-2-9-broken-access-control-vulnerability?_s_id=cve.

RemediationAI

Update the theme to a version later than 2.9. The exact patched version was not specified in the NVD record, but the affected range (“n/a through <=2.9”) implies a fix exists. Monitor the theme’s update stream or the Patchstack advisory for the corrected version number. As a temporary measure, restrict user registration or review roles assigned to untrusted accounts.