CVE-2025-66142: 
WordPress vulnerability analysis and mitigation

CVE-2025-66142 is a Missing Authorization vulnerability in the Comparimager for Elementor WordPress plugin developed by merkulove. It allows authenticated attackers with low-level privileges to exploit incorrectly configured access control security levels. All versions up to and including 1.0.1 are affected. The vulnerability was published on January 22, 2026, and assigned a CVSS v3.1 base score of 5.4 (Medium) by Patchstack (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing certain actions. An authenticated attacker with low privileges can send crafted network requests to trigger functionality that should be restricted to higher-privileged roles. The attack vector is network-based, requires low privileges, no user interaction, and has low attack complexity, making it straightforward to exploit once authenticated (Patchstack).

Successful exploitation results in limited but meaningful impacts to both confidentiality and integrity — an attacker can read and modify data they should not have access to within the affected WordPress installation. Availability is not impacted. The scope is limited to the affected system, but unauthorized data access or modification could facilitate further attacks within the WordPress environment (Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-66142. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Patchstack).

Users should update the Comparimager for Elementor plugin to a version beyond 1.0.1 if a patched release is available from the plugin developer (merkulove). If no patched version is yet available, the recommended workaround is to deactivate and remove the plugin until a fix is released. Site administrators should also audit user roles to ensure only trusted users have authenticated access to the WordPress installation (Patchstack).