CVE-2025-66139: 
WordPress vulnerability analysis and mitigation

CVE-2025-66139 is a Missing Authorization vulnerability in the Audier For Elementor WordPress plugin developed by merkulove. It allows authenticated attackers with low-level privileges to exploit incorrectly configured access control security levels. All versions up to and including 1.0.9 are affected. The vulnerability was published on January 22, 2026, and assigned a CVSS v3.1 base score of 5.4 (Medium) by Patchstack (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing certain actions or accessing certain resources. An authenticated attacker with minimal privileges (e.g., a subscriber-level account) can send crafted network requests to trigger functionality that should be restricted to higher-privileged roles. No user interaction is required, and the attack complexity is low, making it straightforward to exploit once an attacker has any valid WordPress account (Patchstack).

Successful exploitation can result in unauthorized modification of data (low integrity impact) and exposure of some sensitive information (low confidentiality impact) on the affected WordPress site. The scope is limited to the vulnerable plugin's functionality and does not directly enable remote code execution or full system compromise. However, in a shared hosting or multi-tenant environment, unauthorized access to plugin settings or content could facilitate further attacks or data leakage (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-66139. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. The vulnerability requires a low-privileged authenticated account, which somewhat limits opportunistic exploitation. It has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog as of the latest available data (Patchstack).

Users should update the Audier For Elementor plugin to a version beyond 1.0.9 if a patched release is available from the plugin developer (merkulove). If no patched version is yet available, site administrators should consider deactivating and removing the plugin until a fix is released. Additionally, restricting user registration and limiting low-privileged accounts on the WordPress site can reduce the attack surface (Patchstack).