The vulnerability CVE-2025-66528 in VillaTheme Thank You Page Customizer for WooCommerce is due to missing authorization checks, which results in incorrect access control. This affects versions up to and including 1.1.8. The CVSS 3.1 base score is 4.3 (medium), reflecting that the vulnerability can be exploited remotely with low privileges and no user interaction, leading to limited confidentiality impact but no integrity or availability impact. No patch or official fix information is currently available.

An attacker with low privileges could exploit this missing authorization vulnerability to access or manipulate parts of the Thank You Page Customizer functionality that should be restricted. The impact is limited to confidentiality loss with no reported integrity or availability impact. There are no known exploits in the wild, and no further impact details are provided.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin functionality to trusted users only and monitor for suspicious activity related to the Thank You Page Customizer. Avoid granting unnecessary privileges to users who can interact with this plugin.