The vulnerability identified as CVE-2025-66071 concerns a missing authorization control in the Custom Order Numbers for WooCommerce plugin by tychesoftwares. This issue arises from improperly configured access control mechanisms, potentially allowing unauthorized actions related to order number customization. The affected versions include all versions up to 1.11.0. The CVSS score of 5.3 reflects a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity loss. No patch or official fix information is available at this time.

The vulnerability could allow an attacker without privileges to perform unauthorized actions that may alter order number data integrity within the WooCommerce environment. There is no reported impact on confidentiality or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific mitigation steps are provided by the vendor at this time.