CVE-2025-66122: Stylish Price List Auth Bypass Vulnerability

CVE-2025-66122 Overview

CVE-2025-66122 is a missing authorization vulnerability in the Design Stylish Price List WordPress plugin (stylish-price-list). The flaw affects all versions up to and including 7.2.2. Attackers can exploit incorrectly configured access control security levels to reach plugin functionality that should require authorization. The weakness is classified under CWE-862: Missing Authorization. Exploitation requires no authentication, no user interaction, and can be performed remotely over the network. The impact is limited to availability; confidentiality and integrity are not directly affected according to the published CVSS vector.

Critical Impact

Unauthenticated remote attackers can invoke protected plugin actions, enabling availability-impacting abuse on affected WordPress sites.

Affected Products

• Design Stylish Price List stylish-price-list plugin for WordPress
• All versions from initial release through 7.2.2
• WordPress sites with the plugin installed and activated

Discovery Timeline

• 2025-12-16 - CVE-2025-66122 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-66122

Vulnerability Analysis

The Stylish Price List plugin exposes functionality without verifying that the requester has the appropriate authorization. Under [CWE-862], the application performs a sensitive action without first confirming the user is permitted to perform it. In WordPress plugins, this pattern typically appears when AJAX handlers, REST routes, or admin-post endpoints omit current_user_can() checks or rely on client-controlled parameters to gate access.

An unauthenticated attacker can send crafted HTTP requests to the vulnerable endpoints and trigger plugin behavior reserved for privileged users. The CVSS vector indicates a low-complexity network attack with no privileges required and an availability impact on the application scope.

According to the EPSS model, exploitation probability remains low at publication time, but WordPress plugin flaws of this class are frequently automated once proof-of-concept details circulate.

Root Cause

The root cause is an absent or incorrectly configured capability check on one or more plugin endpoints. The plugin trusts the request context rather than enforcing a server-side authorization decision tied to the WordPress user role and capability model.

Attack Vector

The attack vector is network-based through standard HTTP(S) requests to the WordPress site. An attacker identifies the vulnerable action handler exposed by stylish-price-list and submits requests directly, bypassing the intended access control. No credentials, tokens, or user interaction are required. Technical details are available in the Patchstack Security Vulnerability Report.

Detection Methods for CVE-2025-66122

Indicators of Compromise

• Unauthenticated POST or GET requests to admin-ajax.php or REST endpoints referencing stylish-price-list actions
• Unexpected modifications to plugin data, settings, or stored pricing entries
• Spikes in request volume targeting plugin-specific action parameters from a single source

Detection Strategies

• Review WordPress and web server access logs for requests invoking stylish-price-list actions without an authenticated session cookie
• Deploy a web application firewall rule to flag requests to known plugin endpoints that originate from unauthenticated sources
• Enable WordPress audit logging to capture administrative state changes attributable to the plugin

Monitoring Recommendations

• Alert on anomalous HTTP 200 responses to admin-ajax.php with the action parameter tied to the plugin from unauthenticated clients
• Track plugin version inventory across managed WordPress sites to identify hosts still running 7.2.2 or earlier
• Monitor for outbound requests or site defacement that could follow successful exploitation

How to Mitigate CVE-2025-66122

Immediate Actions Required

• Identify all WordPress instances running stylish-price-list version 7.2.2 or earlier
• Update the plugin to a patched release once published by the vendor, or deactivate and remove it if a fix is unavailable
• Restrict access to wp-admin and admin-ajax.php where feasible using IP allowlisting or a WAF

Patch Information

At the time of NVD publication, the advisory lists all versions through 7.2.2 as affected. Site administrators should consult the Patchstack Security Vulnerability Report for the current fixed version and apply the vendor update as soon as it is released.

Workarounds

• Deactivate the stylish-price-list plugin until a patched version is installed
• Apply virtual patching via a WAF rule that blocks unauthenticated access to the plugin's AJAX and REST endpoints
• Enforce authentication at the reverse proxy for admin-ajax.php paths associated with the plugin

# Example nginx rule to block unauthenticated access to the plugin's AJAX action
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "^spl_") {
        set $block 1;
    }
    if ($http_cookie !~* "wordpress_logged_in") {
        set $block "${block}1";
    }
    if ($block = "11") {
        return 403;
    }
}