CVE-2025-66528 Overview
CVE-2025-66528 is a missing authorization vulnerability in the VillaTheme Thank You Page Customizer for WooCommerce plugin. The flaw affects all plugin versions up to and including 1.1.8. It stems from incorrectly configured access control on plugin functionality, classified as [CWE-862].
An authenticated attacker with low privileges can exploit this flaw over the network without user interaction. Exploitation results in a confidentiality impact on the WordPress site, with no direct impact on integrity or availability.
Critical Impact
Authenticated low-privilege users can access plugin functionality intended for higher-privileged roles, exposing sensitive WooCommerce configuration data on affected sites.
Affected Products
- VillaTheme Thank You Page Customizer for WooCommerce plugin
- All versions from initial release through 1.1.8
- WordPress sites running WooCommerce with this plugin enabled
Discovery Timeline
- 2025-12-09 - CVE-2025-66528 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-66528
Vulnerability Analysis
The vulnerability is a broken access control issue in the Thank You Page Customizer for WooCommerce plugin. The plugin exposes functionality without verifying that the requesting user holds the appropriate WordPress capability or role. This allows users with low-level accounts, such as subscriber or customer, to invoke actions reserved for administrators or shop managers.
The issue is categorized under [CWE-862] Missing Authorization. The plugin fails to invoke current_user_can() checks or equivalent capability validation before processing privileged requests. Because WooCommerce sites commonly allow customer registration, the attacker prerequisite of holding a valid account is trivially met.
Exploitation does not require user interaction and can be conducted remotely. The EPSS probability is 0.197%, placing it in the 9.6th percentile for likelihood of exploitation activity.
Root Cause
The root cause is the absence of authorization checks on plugin endpoints or AJAX handlers. Plugin code registers handlers accessible to authenticated users without validating the caller's role or capability. Any user session with a valid nonce or authenticated request context can reach the protected functionality.
Attack Vector
The attack vector is network-based and requires an authenticated session on the target WordPress site. The attacker logs in as a low-privilege user, then sends crafted requests to plugin endpoints that should be gated by administrator capability checks. The vulnerability manifests when the plugin processes these requests and returns or modifies data without authorization enforcement. Refer to the Patchstack Vulnerability Report for technical details.
Detection Methods for CVE-2025-66528
Indicators of Compromise
- Unexpected HTTP POST requests to /wp-admin/admin-ajax.php with action parameters referencing the woo-thank-you-page-customizer plugin originating from non-administrator accounts
- Modifications to thank-you page configuration entries in the wp_options table without corresponding administrator session activity
- Access log entries showing low-privilege user sessions invoking plugin endpoints reserved for shop managers
Detection Strategies
- Audit WordPress access logs for requests to plugin endpoints correlated against the requesting user's role in the database
- Monitor wp_options and plugin-specific tables for unauthorized configuration changes
- Deploy a web application firewall rule that flags AJAX actions from the affected plugin when invoked by users below the manage_woocommerce capability
Monitoring Recommendations
- Enable WordPress audit logging plugins to record capability checks and privileged actions per user
- Track new account registrations followed by immediate requests to administrative plugin endpoints
- Alert on outbound responses from admin-ajax.php containing sensitive configuration fields when triggered by non-admin sessions
How to Mitigate CVE-2025-66528
Immediate Actions Required
- Identify all WordPress sites running Thank You Page Customizer for WooCommerce version 1.1.8 or earlier
- Disable the plugin on affected sites until a patched version is installed
- Review existing user accounts and remove or restrict any suspicious low-privilege accounts created recently
- Audit plugin configuration and thank-you page content for unauthorized modifications
Patch Information
At the time of publication, the vendor advisory tracked by Patchstack indicates the vulnerability affects versions through 1.1.8. Administrators should monitor the Patchstack Vulnerability Report and the VillaTheme plugin page for an updated release that introduces proper capability checks.
Workarounds
- Deactivate the Thank You Page Customizer for WooCommerce plugin until a fixed version is available
- Restrict customer account self-registration on affected WooCommerce stores where business requirements allow
- Apply WAF rules blocking unauthenticated and low-privilege access to plugin AJAX actions
- Limit access to /wp-admin/admin-ajax.php plugin actions by IP allowlist for administrative networks where feasible
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
