CVE-2025-66097: CSRF in I Order Terms WordPress Plugin

The CSRF vulnerability in I Order Terms allows an attacker to craft malicious requests that appear to originate from a legitimate user. If a user clicks on a specially crafted link or visits a compromised website containing the malicious request, the attacker can perform actions as that user within the I Order Terms plugin. This could include modifying order terms, potentially leading to unauthorized changes to order configurations or other sensitive settings. The blast radius is limited to the scope of actions available within the plugin itself, but successful exploitation could still have significant consequences for e-commerce operations.

1. Reserved2025-11-21
2. Published2025-11-21
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-66097 is to immediately upgrade the I Order Terms plugin to version 1.5.1 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing temporary workarounds such as adding CSRF tokens to all sensitive forms and actions within the plugin. Web Application Firewalls (WAFs) configured to detect and block CSRF attacks can also provide an additional layer of protection. Regularly review WordPress plugin configurations and user permissions to minimize the potential impact of successful exploitation.

Active installs

1KNiche

Plugin rating