CVE-2025-66528

MediumCVSS 4.3

Published: 09/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

The Thank You Page Customizer for WooCommerce plugin (versions up to and including 1.1.8) contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. This enables unauthorized users to perform protected operations.

Risk Assessment

An attacker could exploit the misconfigured access control levels to modify settings or access data they are not authorized to use. This may result in unauthorized changes within the WooCommerce store.

Recommendation

Update the Thank You Page Customizer for WooCommerce plugin to a version newer than 1.1.8 once a fix is available. Until then, consider restricting access to the plugin's functionality.

Other vulnerabilities in Thank You Page Customizer for WooCommerce

CVE-2026-81786High
The Thank You Page Customizer for WooCommerce plugin in versions up to and including 1.2.2 contains a broken access control flaw that allows an unauthenticated attacker to perform unauthorized operations.

Original NVD description (English source)

Missing Authorization vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Thank You Page Customizer for WooCommerce: from n/a through <= 1.1.8.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS