CVE-2025-66157: 
WordPress vulnerability analysis and mitigation

CVE-2025-66157 is a Missing Authorization vulnerability in the Sliper for Elementor WordPress plugin (by merkulove) that allows authenticated low-privileged attackers to exploit incorrectly configured access control security levels. It affects all versions of the plugin through 1.0.10. The CVE was published on December 31, 2025, and assigned by Patchstack. It carries a CVSS v3.1 base score of 5.4 (Medium) (Feedly, Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify that an authenticated user has the appropriate permissions before allowing access to certain functionality. An attacker with a low-privileged WordPress account (e.g., Subscriber role) can send crafted network requests to perform actions that should be restricted to higher-privileged users, such as modifying or disabling slider content. No complex attack conditions are required — the attack vector is network-based, requires low privileges, no user interaction, and has low attack complexity (Feedly).

Successful exploitation allows authenticated low-privileged users to tamper with slider data managed by the plugin, resulting in limited integrity and availability impacts. Specifically, attackers can modify or disable slider content on affected WordPress sites, potentially defacing or disrupting site functionality. There is no confidentiality impact, and the scope is limited to the affected WordPress installation without evidence of lateral movement potential (Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-66157. The EPSS score is approximately 0.036%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Feedly).

WordPress site administrators should update the Sliper for Elementor plugin to a version beyond 1.0.10 if a patched release is available. If no patched version exists, the recommended workaround is to deactivate and remove the plugin until a fix is released. Access to the WordPress admin panel should be restricted to trusted users, and the principle of least privilege should be enforced for all WordPress user roles (Patchstack).