CVE-2025-66151: 
WordPress vulnerability analysis and mitigation

CVE-2025-66151 is a Missing Authorization (Broken Access Control) vulnerability in the Countdowner for Elementor WordPress plugin developed by merkulove. It allows authenticated attackers with low-level privileges to exploit incorrectly configured access control security levels. All versions up to and including 1.0.4 are affected. The CVE was published on December 31, 2025, and assigned by Patchstack. It carries a CVSS v3.1 base score of 5.4 (Medium) (Feedly, Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before executing certain actions. An attacker with a low-privileged WordPress account (e.g., Subscriber role) can send crafted network requests to trigger restricted plugin functionality without proper capability checks. The attack vector is network-based, requires low privileges, no user interaction, and has low attack complexity, making it straightforward to exploit for any authenticated user on the affected WordPress site (Feedly, Patchstack).

Successful exploitation results in limited but meaningful impacts to both integrity and availability of the affected WordPress site. An attacker can make unauthorized modifications to plugin-controlled data or settings (integrity impact: Low) and may cause minor disruption to plugin functionality (availability impact: Low). There is no confidentiality impact, and the scope is unchanged, meaning exploitation is confined to the vulnerable component without direct lateral movement to other systems (Feedly).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2025-66151 as of the available data. The EPSS score is approximately 0.036%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

1. Reconnaissance: Identify WordPress sites running the Countdowner for Elementor plugin (version ≤ 1.0.4) using tools like WPScan or by inspecting plugin directories exposed via the target site.
2. Obtain low-privileged access: Register or obtain credentials for a low-privileged WordPress account (e.g., Subscriber), as the vulnerability requires authentication with minimal privileges.
3. Identify unprotected endpoints: Enumerate AJAX actions or REST API endpoints registered by the plugin that lack proper current_user_can() or nonce capability checks.
4. Send unauthorized request: Craft and submit an HTTP POST or GET request to the vulnerable endpoint (e.g., WordPress admin-ajax.php with the relevant action parameter) without the expected authorization, bypassing access controls.
5. Achieve objective: Depending on the unprotected action, modify plugin settings, manipulate countdown timer data, or trigger availability-impacting operations on the site (Feedly, Patchstack).

• Logs: WordPress access logs showing authenticated low-privileged users (Subscriber, Contributor) making POST requests to wp-admin/admin-ajax.php with action parameters associated with the Countdowner for Elementor plugin outside of normal usage patterns.
• Logs: Unexpected modifications to countdown timer settings or plugin configuration entries in the WordPress database (wp_options or plugin-specific tables) without corresponding administrator activity.
• Network: Repeated or scripted requests to WordPress AJAX endpoints from the same authenticated session targeting plugin-specific actions.
• File System: No file-system artifacts are expected for this vulnerability type, as exploitation is limited to unauthorized function calls rather than file writes.

The primary remediation is to update the Countdowner for Elementor plugin to a version beyond 1.0.4 that includes proper authorization checks. Site administrators should check the WordPress plugin repository or the vendor's page for a patched release. As a temporary workaround, consider deactivating the plugin until a patch is available, or restricting site registration to prevent untrusted users from obtaining low-privileged accounts. Regularly auditing installed plugins for access control issues using tools like Patchstack or WPScan is also recommended (Patchstack).