CVE-2025-66164

The Laser plugin for WordPress, versions 1.1.1 and earlier, contains a missing authorization vulnerability. This flaw stems from improperly configured access control security levels, allowing unauthenticated or low-privileged users to execute higher-privileged actions without proper checks [1].

Exploitation does not require authentication in many cases, making it suitable for automated mass-exploit campaigns. An attacker can send crafted requests to the vulnerable endpoint, bypassing the intended access restrictions [1].

Successful exploitation enables an attacker to escalate privileges, potentially gaining administrative control over the WordPress site. This could lead to full site compromise, including data theft, defacement, or further malware injection [1].

The vendor has not released a patch for versions beyond 1.1.1, so affected users should update the plugin to the latest available version. If an update is not possible, applying a Web Application Firewall rule or disabling the plugin may serve as a temporary workaround [1].