CVE-2025-66163: 
WordPress vulnerability analysis and mitigation

CVE-2025-66163 is a Missing Authorization (Broken Access Control) vulnerability in the Masker for Elementor WordPress plugin developed by merkulove. It allows authenticated attackers with low-level privileges to exploit incorrectly configured access control security levels. All versions up to and including 1.1.4 are affected. The vulnerability was disclosed on December 16, 2025, and assigned a CVSS v3.1 base score of 5.4 (Medium) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization) — the plugin fails to properly verify whether a requesting user has the appropriate permissions before executing certain privileged actions. An authenticated attacker with low privileges (e.g., a subscriber-level WordPress account) can send crafted network requests to trigger functionality that should be restricted to higher-privileged roles. No complex attack conditions are required (low attack complexity, no user interaction needed). No public proof-of-concept code has been identified at this time (Feedly, Patchstack).

Successful exploitation results in limited but meaningful confidentiality and integrity impacts — an attacker can read restricted data and make unauthorized modifications within the scope of the plugin's functionality. Availability is not impacted. The scope is unchanged, meaning exploitation is confined to the vulnerable component and does not directly enable lateral movement to other systems. The primary risk is unauthorized manipulation of Elementor masking configurations or access to protected content on affected WordPress sites (Feedly).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-66163. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid (low-privileged) account on the target WordPress site, which limits opportunistic mass exploitation (Feedly).

Users should update the Masker for Elementor plugin to a version beyond 1.1.4 if a patched release is available from the plugin developer (merkulove). If no patch is yet available, site administrators should consider deactivating the plugin until a fix is released, or restricting WordPress site registration to trusted users only to reduce the attack surface. Monitoring WordPress user activity logs for unexpected access to plugin-related endpoints is also advisable (Patchstack).