CVE-2025-66165: 
WordPress vulnerability analysis and mitigation

CVE-2025-66165 is a Missing Authorization vulnerability in the Lottier for WPBakery WordPress plugin developed by merkulove. The flaw allows authenticated attackers with low-level privileges to exploit incorrectly configured access control security levels. All versions of the plugin through 1.1.7 are affected. The vulnerability was published on December 16, 2025, and assigned a CVSS v3.1 base score of 5.4 (Medium) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization) — the plugin fails to properly verify whether a requesting user has the appropriate permissions before executing certain privileged actions. The attack vector is network-based, requires low privileges (an authenticated WordPress user account), and no user interaction. Because authorization checks are absent or misconfigured, a low-privileged user can invoke plugin functionality that should be restricted to higher-privileged roles such as administrators (Feedly, Patchstack). No public proof-of-concept exploit code has been identified at this time.

Successful exploitation results in limited but meaningful confidentiality and integrity impacts — a low-privileged authenticated attacker can read or modify data that should be restricted, with no direct availability impact. The scope is confined to the affected WordPress installation; however, unauthorized modification of plugin-managed content (Lottie animations embedded via WPBakery) could allow content tampering or information disclosure. Lateral movement potential is low, but the vulnerability could be chained with other weaknesses in a broader attack against a WordPress site (Feedly).

No active in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is very low at approximately 0.017%, indicating a low probability of exploitation in the near term. Exploitation requires an authenticated session (any low-privileged WordPress account), which limits opportunistic mass exploitation but makes it relevant in shared hosting or multi-user WordPress environments (Feedly).

1. Reconnaissance: Identify WordPress sites running the Lottier for WPBakery plugin (version ≤ 1.1.7) using tools like WPScan or by inspecting plugin directories/readme files.
2. Obtain low-privileged access: Register or obtain credentials for any low-privileged WordPress account (e.g., Subscriber role) on the target site.
3. Identify unprotected endpoints: Enumerate AJAX actions or REST API endpoints registered by the plugin that lack proper capability checks (e.g., wp_ajax_ hooks without current_user_can() validation).
4. Send unauthorized request: Craft and send an authenticated HTTP request (with a valid nonce if required) to the vulnerable endpoint, invoking plugin functionality normally restricted to administrators.
5. Achieve objective: Depending on the specific unprotected action, read sensitive plugin configuration data or modify Lottie animation settings/content beyond the attacker's intended privilege level (Feedly, Patchstack).

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/admin-ajax.php with action parameters associated with the Lottier for WPBakery plugin from low-privileged user accounts; unexpected access to plugin-specific REST API endpoints by subscriber-level users.
• File System: Unexpected modifications to Lottie animation files or plugin configuration stored in the WordPress uploads or plugin directory.
• Process/Application: WordPress audit logs (if enabled via a plugin such as WP Activity Log) recording unauthorized settings changes attributed to low-privileged user accounts interacting with the lottier-wpbakery plugin.

The primary remediation is to update the Lottier for WPBakery plugin to a version beyond 1.1.7 that includes proper authorization checks. Site administrators should verify the current plugin version and apply any available update from the WordPress plugin repository or the vendor. If no patched version is yet available, consider deactivating the plugin until a fix is released. Additionally, restrict WordPress user registrations and minimize the number of accounts with any authenticated access to reduce the attack surface (Patchstack).