CVE-2025-66138: 
WordPress vulnerability analysis and mitigation

CVE-2025-66138 is a Missing Authorization vulnerability in the Motionger for Elementor WordPress plugin developed by merkulove. It allows authenticated attackers with low-level privileges to exploit incorrectly configured access control security levels, potentially gaining unauthorized access to restricted functions and data. The vulnerability affects all versions of the plugin up to and including 2.0.4. It was published on January 22, 2026, by Patchstack. The CNA (Patchstack) assigned a CVSS v3.1 base score of 5.4 (Medium), while CISA-ADP initially scored it 8.8 (High) before the Patchstack score was added (NVD, Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before allowing access to certain functions or endpoints. An attacker with a low-privileged WordPress account (e.g., Subscriber role) can send network requests to restricted plugin functionality without proper authorization checks being enforced. No complex conditions or special configurations are required to trigger the flaw, as the attack complexity is low and no user interaction is needed (NVD, Patchstack).

Successful exploitation could allow a low-privileged authenticated attacker to access or modify data and functionality that should be restricted to higher-privileged users such as administrators. Based on the Patchstack CVSS assessment, the primary impacts are limited confidentiality and integrity compromise (e.g., unauthorized data access or modification), with no direct availability impact. The scope is limited to the affected WordPress installation, but unauthorized access to plugin administrative functions could facilitate further privilege escalation or site defacement (NVD).

There is no public proof-of-concept exploit code available, and no evidence of in-the-wild exploitation has been reported at this time. The vulnerability requires the attacker to have at least a low-privileged authenticated account on the target WordPress site. The EPSS score is 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (NVD, Patchstack).

Users should upgrade the Motionger for Elementor plugin to a version newer than 2.0.4 as soon as a patched release becomes available. As an interim measure, site administrators should implement additional server-level or WAF-based access controls to restrict unauthorized access to plugin endpoints. If the plugin is not actively in use, consider disabling or uninstalling it until a security update is released. Regularly audit WordPress user roles and permissions to limit the number of low-privileged accounts that could be leveraged in an attack (NVD, Patchstack).