CVE-2025-66144: 
WordPress vulnerability analysis and mitigation

CVE-2025-66144 is a Missing Authorization (Broken Access Control) vulnerability in the Worker for Elementor WordPress plugin by merkulove. It affects all versions from n/a through 1.0.10 and allows authenticated attackers with low-level privileges to exploit incorrectly configured access control security levels. The vulnerability was published on December 31, 2025, and assigned by Patchstack. It carries a CVSS v3.1 base score of 5.4 (Medium) (Patchstack, NVD).

The root cause is classified as CWE-862 (Missing Authorization) — the plugin fails to properly verify whether an authenticated user has the appropriate permissions before allowing access to certain functionality. An attacker with a low-privileged WordPress account (e.g., Subscriber) can send crafted network requests to plugin endpoints that lack proper capability checks, bypassing intended access controls. No user interaction is required, and the attack complexity is low, making it straightforward to exploit once authenticated (NVD, Patchstack).

Successful exploitation allows authenticated attackers to tamper with site content (integrity impact) and cause limited service disruption (availability impact). There is no confidentiality impact, meaning sensitive data exposure is not a direct consequence. The scope is limited to the affected WordPress installation, but content modification could be leveraged for defacement or to disrupt site functionality (NVD, Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-66144. The EPSS score is approximately 0.036%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a low-privileged authenticated account on the target WordPress site (NVD, Feedly).

1. Reconnaissance: Identify WordPress sites running the Worker for Elementor plugin (version ≤ 1.0.10) using tools like WPScan or by inspecting plugin directories.
2. Obtain low-privileged access: Register or obtain credentials for a low-privileged WordPress account (e.g., Subscriber role) on the target site.
3. Identify unprotected endpoints: Enumerate plugin AJAX actions or REST API endpoints registered by the Worker for Elementor plugin that lack proper current_user_can() or capability checks.
4. Send crafted requests: Issue authenticated HTTP requests (e.g., POST to wp-admin/admin-ajax.php with the relevant action parameter) to the unprotected endpoint, bypassing the intended authorization controls.
5. Achieve objective: Modify plugin-controlled site content or trigger actions that cause limited availability disruption, consistent with the integrity and availability impacts described in the CVSS scoring (NVD, Patchstack).

• Logs: WordPress access logs showing repeated POST requests to wp-admin/admin-ajax.php with plugin-specific action parameters from low-privileged user accounts at unusual times.
• Logs: WordPress debug or error logs showing unauthorized access attempts to Worker for Elementor plugin functions.
• File System: Unexpected modifications to Elementor-managed page content or plugin configuration files.
• Network: Unusual authenticated HTTP POST traffic to WordPress AJAX endpoints originating from unfamiliar IP addresses associated with low-privileged accounts.

Update the Worker for Elementor plugin to version 1.0.11 or later, which contains the fix for this missing authorization issue. Site administrators should apply the update immediately via the WordPress plugin dashboard. As a temporary measure, consider restricting new user registrations or auditing existing low-privileged accounts until the patch is applied (Feedly, Patchstack).