CVE-2025-66146: 
WordPress vulnerability analysis and mitigation

CVE-2025-66146 is a Missing Authorization (Broken Access Control) vulnerability in the Logger for Elementor WordPress plugin developed by merkulove. It affects all versions from n/a through 1.0.9 and allows authenticated low-privileged users to exploit incorrectly configured access control security levels to modify or delete data. The vulnerability was published on December 31, 2025, and assigned by Patchstack. It carries a CVSS v3.1 base score of 5.4 (Medium) (Patchstack, Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before allowing access to certain functionality. An attacker with a low-privileged WordPress account (e.g., subscriber or contributor) can send crafted network requests to plugin endpoints that lack proper capability checks, enabling unauthorized data modification or deletion. No user interaction is required, and the attack complexity is low, making it straightforward to exploit once an authenticated session is obtained (Patchstack, Red Hat CVE).

Successful exploitation allows a low-privileged authenticated attacker to tamper with or delete log data managed by the Logger for Elementor plugin, impacting data integrity and availability. Confidentiality is not directly affected (no data disclosure). While the scope is limited to the plugin's functionality, manipulation of activity logs could allow an attacker to cover tracks or disrupt audit trails on the affected WordPress site (Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-66146. The EPSS score is approximately 0.036%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid low-privileged account on the target WordPress site, limiting opportunistic mass exploitation (Red Hat CVE).

Users should update the Logger for Elementor plugin to version 1.1.0 or later, which contains the fix for this broken access control issue. Site administrators should audit user accounts for unexpected low-privileged accounts that may have been created or abused. As a general hardening measure, restrict plugin installation and user registration on WordPress sites to trusted individuals only (Patchstack).