CVE-2025-66135: 
WordPress vulnerability analysis and mitigation

CVE-2025-66135 is a Missing Authorization vulnerability in the Imager for Elementor WordPress plugin developed by merkulove. It allows low-privileged authenticated attackers to exploit incorrectly configured access control security levels, affecting all versions through 2.0.4. The vulnerability was published on January 22, 2026, by Patchstack. The CNA (Patchstack) assigned a CVSS v3.1 base score of 5.4 (Medium), while an earlier CISA-ADP score of 8.8 (High) was subsequently removed in favor of the Patchstack assessment (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing sensitive operations. An authenticated attacker with low-level privileges (e.g., a subscriber or contributor role) can send crafted network requests to invoke plugin functionality that should be restricted to administrators. No complex preconditions or user interaction are required beyond having a valid low-privileged account on the target WordPress site (Patchstack).

Successful exploitation allows a low-privileged authenticated attacker to access or modify functionality intended for administrators within the Imager for Elementor plugin environment. This can result in unauthorized disclosure of limited confidential information and unauthorized modification of plugin-controlled content or settings (confidentiality and integrity impact), though availability impact appears minimal based on the revised Patchstack CVSS score. The scope is limited to the WordPress installation hosting the vulnerable plugin (Patchstack).

There is no public proof-of-concept exploit code known at this time, and no evidence of active in-the-wild exploitation has been reported. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid low-privileged account on the target WordPress site, which somewhat limits opportunistic mass exploitation (Patchstack).

Site administrators should update the Imager for Elementor plugin to a version newer than 2.0.4 as soon as a patched release becomes available from the vendor (merkulove). In the interim, restrict plugin access to trusted administrator accounts only, and review WordPress user roles to ensure no unnecessary low-privileged accounts exist. Monitoring access logs for unusual API calls or requests to plugin-specific endpoints can help detect potential abuse. Disabling the plugin entirely is an option if it is not critical to site operations (Patchstack).