The vulnerability identified as CVE-2025-66109 affects the Cart Weight for WooCommerce plugin by Octolize Shipping Plugins. It is classified as a Missing Authorization issue, meaning that the plugin does not properly enforce access control, potentially allowing unauthorized actions. The affected versions include all releases up to 1.9.11. The CVSS 3.1 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The impact is limited to integrity loss without confidentiality or availability impact. No patch or vendor advisory is currently provided, and no exploits are known in the wild.

The vulnerability allows unauthorized users to perform actions that should require authorization, potentially leading to integrity issues within the affected WooCommerce plugin. There is no impact on confidentiality or availability reported. Since no known exploits exist in the wild, the immediate risk is moderate but could increase if exploitation techniques emerge.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor for updates from Octolize Shipping Plugins and consider restricting access to the affected plugin functionality where possible to reduce exposure.