CVE-2025-66528
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Thank You Page Customizer for WooCommerce plugin (versions up to and including 1.1.8) contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. This enables unauthorized users to perform protected operations.
Risk Assessment
An attacker could exploit the misconfigured access control levels to modify settings or access data they are not authorized to use. This may result in unauthorized changes within the WooCommerce store.
Recommendation
Update the Thank You Page Customizer for WooCommerce plugin to a version newer than 1.1.8 once a fix is available. Until then, consider restricting access to the plugin's functionality.
Other vulnerabilities in Thank You Page Customizer for WooCommerce
See all- CVE-2026-103071High
Code injection vulnerability in the Thank You Page Customizer for WooCommerce plugin. Allows code injection. Affects versions up to 1.2.3.
- CVE-2026-81786High
The Thank You Page Customizer for WooCommerce plugin in versions up to and including 1.2.2 contains a broken access control flaw that allows an unauthenticated attacker to perform unauthorized operations.
Original NVD description (English source)
Missing Authorization vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Thank You Page Customizer for WooCommerce: from n/a through <= 1.1.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS