The vulnerability identified as CVE-2025-66074 affects the WP Webhooks plugin by Cozmoslabs, allowing an attacker to upload files of dangerous types without restriction. This can lead to path traversal, enabling the attacker to write files to arbitrary locations on the server. The vulnerability affects all versions up to and including 3.3.8. The CVSS v3.1 base score is 9.0, reflecting network attack vector, no privileges required, no user interaction, high attack complexity, and complete impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to upload malicious files and potentially execute arbitrary code, compromise sensitive data, or disrupt service availability. The path traversal aspect increases the risk by permitting file writes outside intended directories, which can lead to full system compromise.

No patch or official fix information is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, it is recommended to restrict file upload permissions, disable or limit the use of the WP Webhooks plugin if possible, and monitor for suspicious activity related to file uploads.