The vulnerability identified as CVE-2025-66080 involves missing authorization controls in the WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin. This issue arises from improperly configured access control mechanisms, potentially allowing unauthorized users to interact with functionality that should be restricted. The affected versions include all releases up to and including 4.0.3. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and an impact limited to availability (no confidentiality or integrity impact). No vendor patch or advisory details are currently available.

The vulnerability could allow an attacker to cause a denial of service or availability impact by exploiting missing authorization controls. There is no reported impact on confidentiality or integrity. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin's administrative interfaces where possible and monitor for updates from WP Legal Pages regarding a patch or mitigation steps.