The vulnerability identified as CVE-2025-66072 in the Stiofan UsersWP plugin arises from missing authorization controls. This issue affects all versions up to 1.2.47 and allows attackers to exploit improperly configured access control mechanisms. The CVSS score of 5.3 indicates a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The impact is limited to integrity, with no confidentiality or availability impact reported. No vendor patch or advisory is currently available, and the plugin is not a cloud service.

The vulnerability allows unauthorized users to perform actions that should require authorization, impacting the integrity of the affected system. There is no reported impact on confidentiality or availability. Since no known exploits are in the wild, the immediate risk appears moderate but could increase if exploitation techniques emerge.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should review and tighten access control configurations in UsersWP where possible and monitor for updates from Stiofan regarding patches or mitigations.