CVE-2025-66097

Vulnerability

Overview

A Cross-Site Request Forgery (CSRF) vulnerability exists in the I Order Terms plugin for WordPress, affecting versions from n/a through 1.5.0. The flaw allows an attacker to trick a privileged user into performing unwanted actions on their behalf, without their consent or knowledge [1].

Exploitation

Exploitation requires user interaction: a privileged user must click a malicious link, visit a crafted page, or submit a specially designed form. The attacker does not need direct access to the site but can leverage social engineering to force actions under the victim's authenticated session [1].

Impact

Successful exploitation could allow an attacker to execute unwanted administrative actions, such as modifying plugin settings or other operations, under the victim's current authentication. The CVSS score is 4.3 (Medium, indicating a moderate severity [1].

Mitigation

The vulnerability has been patched in version 1.5.1. Users are strongly advised to update immediately. If updating is not possible, consulting a hosting provider or web developer for assistance is recommended. Patchstack users can enable auto-updates for vulnerable plugins [1].