CVE-2025-66076: Woostify Sites Library Auth Bypass Flaw

CVE-2025-66076 Overview

CVE-2025-66076 is a broken access control vulnerability affecting the Woostify Sites Library WordPress plugin in versions up to and including 1.6.2. The flaw allows unauthenticated attackers to reach functionality that should require authentication or authorization checks. The weakness is categorized under CWE-862: Missing Authorization. Because the attack originates over the network without user interaction, any WordPress site running an affected version is reachable by remote actors. The vulnerability impacts integrity of the affected site but does not directly expose confidential data or degrade availability.

Critical Impact
Unauthenticated network-based attackers can invoke plugin functionality that lacks authorization checks, enabling unintended modifications to WordPress sites running Woostify Sites Library <= 1.6.2.

Affected Products

Woostify Sites Library WordPress plugin versions <= 1.6.2
WordPress installations with the Woostify Sites Library plugin activated
Sites deployed using Woostify starter site templates via the affected plugin

Discovery Timeline

2026-07-02 - CVE-2025-66076 published to the National Vulnerability Database
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2025-66076

Vulnerability Analysis

The vulnerability is a broken access control issue in the Woostify Sites Library plugin for WordPress. The plugin exposes functionality that does not properly verify the caller's identity or permission level before executing privileged operations. An unauthenticated attacker can invoke these endpoints directly over HTTP without providing valid credentials or a WordPress nonce. The affected functionality is available on any site running plugin versions <= 1.6.2. According to the Patchstack advisory, the issue permits access to plugin actions that should be restricted to authorized administrators. The impact is limited to integrity, meaning attackers can alter plugin-controlled state but cannot directly read protected data or disrupt service.

Root Cause

The root cause is a missing authorization check [CWE-862] in one or more plugin request handlers. The affected code paths execute their intended action without calling WordPress capability checks such as current_user_can() or verifying a valid nonce with check_ajax_referer(). As a result, the server treats requests from anonymous clients as if they came from a privileged user.

Attack Vector

Exploitation occurs over the network against the WordPress site's HTTP interface. The attacker sends a crafted request to the vulnerable plugin endpoint, typically an admin-ajax.php or REST API route registered by Woostify Sites Library. No authentication, session, or user interaction is required. The vulnerability manifests when the request handler proceeds to execute its logic without first validating the caller's role or capability. Refer to the Patchstack Vulnerability Advisory for handler-level technical details.

Detection Methods for CVE-2025-66076

Indicators of Compromise

Unexpected requests to Woostify Sites Library endpoints under wp-admin/admin-ajax.php or plugin REST routes from unauthenticated sources
Unauthorized changes to imported demo content, template libraries, or plugin option values
Access log entries showing repeated hits to plugin action names without a corresponding authenticated session cookie

Detection Strategies

Inventory WordPress deployments and flag any installation of Woostify Sites Library at version 1.6.2 or earlier
Review web server access logs for HTTP requests referencing plugin action parameters originating from external IPs without valid wordpress_logged_in_* cookies
Correlate WordPress audit logs with file system changes to detect unauthorized plugin-driven modifications

Monitoring Recommendations

Enable a WordPress activity logging plugin to record option changes, imports, and administrative actions
Forward web server and PHP error logs to a centralized log platform for anomaly analysis
Alert on spikes in traffic to admin-ajax.php with plugin-specific action values from anonymous clients

How to Mitigate CVE-2025-66076

Immediate Actions Required

Identify all WordPress sites running Woostify Sites Library and confirm the installed version
Update the Woostify Sites Library plugin to a version later than 1.6.2 as soon as a fixed release is available from the vendor
Deactivate and remove the plugin on sites where the functionality is not required

Patch Information

CVE-2025-66076 affects Woostify Sites Library versions <= 1.6.2. Consult the Patchstack advisory and the plugin's WordPress.org listing for the current fixed version and release notes. Apply the patched release across all affected environments and verify the version after upgrade.

Workarounds

Restrict access to wp-admin/admin-ajax.php and plugin REST routes via a web application firewall (WAF) rule that blocks unauthenticated requests to Woostify-specific action names
Disable the Woostify Sites Library plugin until a fixed version can be installed
Enforce IP allow-listing for administrative endpoints where feasible

bash

# Example WAF rule concept blocking unauthenticated calls to the plugin action
# Adjust the action parameter value to match the vulnerable handler identified in the advisory
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1006676,msg:'Block unauth Woostify Sites Library action'"
  SecRule ARGS:action "@rx ^(woostify_sites_library_[a-z_]+)$" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"