CVE-2025-66131CWE-862broken-access-control

CVE-2025-66131

Medium · published December 16, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
17.9
In the wild
Unconfirmed
What it is

⚠️ Oops, it seems a missing authorization check has crept into the Yaad Sarig Payment Gateway! This means anyone might sneak past security and grab critical data! Think of it like a ticket office that lets anyone through the barrier without checking their tickets — once you’re in, the whole show is up for grabs! 🎟️ This could allow malicious users to access sensitive payment information and even manipulate transactions, leading to potential financial losses and a severely damaged reputation. It's not a total disaster yet, but it sure could be if left unchecked!

Put simply

Think of it like a ticket office that lets anyone through the barrier without checking their tickets — once you’re in, the whole show is up for grabs! 🎟️ The missing authorization vulnerability in the Yaad Sarig Payment Gateway allows users to exploit incorrectly configured access controls, meaning they can perform actions outside their intended permissions.

What to do

This could allow malicious users to access sensitive payment information and even manipulate transactions, leading to potential financial losses and a severely damaged reputation. It's not a total disaster yet, but it sure could be if left unchecked! To safeguard your system, update the Yaad Sarig Payment Gateway For WC to version 2.2.12 immediately and review your access control settings thoroughly. Regularly audit your configurations to prevent similar issues in the future. You’ve got this! Tackle these steps and protect your payment systems like the security hero you are! 🛡️

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00267 · 17.9th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-12-16T14:15Z
References (1)
EPSS history
Timeline
  • 16 DEC 08:12Z
    WordPress Yaad Sarig Payment Gateway For WC plugin <= 2.2.11 - Broken Access Control vulnerability
    cvelistv5