Broken Access Control in wpWax Legal Pages Plugin
CVE-2025-66077

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Legal Pages
Vendor
CVE Published:
21 November 2025

What is CVE-2025-66077?

A missing authorization vulnerability in the wpWax Legal Pages plugin allows attackers to exploit improperly configured access control measures. This flaw can lead to unauthorized access to sensitive functionalities, specifically affecting versions up to 1.4.6. Proper security validation is crucial to mitigate potential threats and protect user data.

Affected Version(s)

Legal Pages <= n/a

References

https://vdp.patchstack.com/database/Wordpress/Plugin/lega...
vdb-entry

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Legion Hunter | Patchstack Bug Bounty Program
JSON
.
CVE-2025-66077 : Broken Access Control in wpWax Legal Pages Plugin