CVE-2025-66152: 
WordPress vulnerability analysis and mitigation

CVE-2025-66152 is a Missing Authorization vulnerability (CWE-862) in the Criptopayer for Elementor WordPress plugin developed by merkulove. It allows authenticated low-privileged attackers to exploit incorrectly configured access control security levels, affecting all versions from n/a through 1.0.1. The CVE was published on December 31, 2025, and assigned by Patchstack. It carries a CVSS v3.1 base score of 5.4 (Medium) (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before allowing access to certain plugin functions. An attacker with a low-privileged WordPress account (e.g., subscriber) can send crafted network requests to invoke plugin endpoints or actions that should be restricted to higher-privileged roles. No user interaction is required, and the attack complexity is low, making it straightforward to exploit once authenticated. No public proof-of-concept code has been identified at this time (Patchstack, Red Hat CVE).

Successful exploitation allows a low-privileged authenticated attacker to modify plugin settings or disable plugin functionality, impacting both the integrity and availability of the affected WordPress site. Confidentiality is not directly impacted (no data exposure), but an attacker could disrupt payment-related features provided by the Criptopayer plugin, potentially affecting site revenue or user experience. The scope is limited to the affected plugin and does not extend to the broader WordPress installation or server (Patchstack).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-66152. The EPSS score is approximately 0.036%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid (low-privileged) WordPress account on the target site, limiting opportunistic mass exploitation (Red Hat CVE, Feedly).

Users should update the Criptopayer for Elementor plugin to version 1.0.2 or later, which contains the fix for this broken access control issue. No configuration-based workaround has been publicly documented; upgrading is the recommended and primary remediation step. WordPress site administrators can also temporarily deactivate the plugin until the update can be applied if immediate patching is not feasible (Patchstack, Red Hat CVE).