Atomic Edge analysis of CVE-2025-66076 (metadata-based): This vulnerability involves a missing authorization check in the Woostify Sites Library plugin for WordPress, affecting versions up to and including 1.6.2. The CWE classification of Missing Authorization (CWE-862) indicates that a function accessible to unauthenticated attackers lacks a capability or permission check. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms that no authentication is required, and the attack complexity is low.
The root cause is likely a missing capability check on a WordPress AJAX handler or REST API endpoint registered by the plugin. In WordPress, plugin developers often use the `wp_ajax_` and `wp_ajax_nopriv_` hooks to register AJAX actions for authenticated and unauthenticated users respectively, or create custom REST API routes. A missing `current_user_can()` or similar capability check in the callback function allows unauthenticated users to trigger actions intended only for administrators or users with specific permissions. Since no code diff is available, this conclusion is inferred from the CWE and description, but the pattern is common in plugin vulnerabilities.
The exploitation method is straightforward. An unauthenticated attacker sends a crafted HTTP request to a WordPress AJAX endpoint or REST API route. For AJAX, the endpoint is typically `/wp-admin/admin-ajax.php` with the `action` parameter set to a plugin-specific action (e.g., `woostify_sites_library_import` or similar). The request may contain additional parameters controlling the action. For REST API, the endpoint would be under `/wp-json/woostify-sites-library/v1/`. The absence of a nonce or capability check means the plugin processes the request without verifying the user’s identity or permissions. Atomic Edge analysis identifies the AJAX handler as the most likely attack vector based on the plugin slug and common WordPress plugin patterns.
Remediation requires adding proper capability checks to the vulnerable function. The plugin developer should use `current_user_can()` with an appropriate capability like `manage_options` or `import` for any administrative actions. Additionally, nonce verification via `check_ajax_referer()` or `check_admin_referer()` should be implemented to protect against cross-site request forgery. Since no patched version is available, site administrators should disable the plugin until an update is released.
Impact is limited to unauthorized actions that modify plugin state or trigger import/export operations, but do not directly expose sensitive data or allow elevation to full administrative access. The CVSS Confidentiality impact is None, Integrity impact is Low, and Availability impact is None. However, an attacker could potentially import malicious content or modify site appearance, depending on the exact action exposed.
