The vulnerability identified as CVE-2025-66073 affects the WP Webhooks plugin by Cozmoslabs, specifically versions up to and including 3.3.8. It involves deserialization of untrusted data, which enables an attacker with high privileges to perform object injection attacks. The CVSS 3.1 base score is 7.2, indicating a high impact with network attack vector, low attack complexity, requiring high privileges, no user interaction, and resulting in high confidentiality, integrity, and availability impacts. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability can lead to full compromise of the affected WordPress environment, including unauthorized code execution or manipulation of data, due to object injection via deserialization of untrusted input. The attacker must have high privileges to exploit this issue, but no user interaction is required. The impact covers confidentiality, integrity, and availability, all rated high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to high-privilege accounts and monitor for suspicious activity related to WP Webhooks. Avoid exposing the plugin to untrusted input sources where possible.