CVE-2025-66167: 
WordPress vulnerability analysis and mitigation

CVE-2025-66167 is a Missing Authorization (Broken Access Control) vulnerability in the Lottier WordPress plugin (lottier-gutenberg) developed by merkulove. It affects all versions of the plugin through and including version 1.1.1, allowing authenticated attackers with low-level privileges to exploit incorrectly configured access control security levels. The vulnerability was published on December 16, 2025, and carries a CVSS v3.1 base score of 5.4 (Medium) (NVD, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before allowing access to certain functionality or endpoints. An attacker with a low-privileged WordPress account (e.g., Subscriber role) can send network-based requests to restricted plugin functions without proper capability checks, exploiting the misconfigured access control. No user interaction is required, and attack complexity is low. No public proof-of-concept code or detailed technical write-up was available at the time of this report (NVD, Patchstack).

Successful exploitation results in limited but meaningful confidentiality and integrity impacts — an authenticated low-privileged attacker can access or modify data they should not be authorized to interact with, such as plugin settings or Lottie animation assets managed by the plugin. Availability is not impacted. The scope is limited to the affected WordPress installation, but unauthorized modification of content or settings could facilitate further attacks or defacement (NVD).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-66167. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid low-privileged account on the target WordPress site, which limits opportunistic mass exploitation (NVD).

Users should update the Lottier WordPress plugin to a version beyond 1.1.1 if a patched release is available from the plugin developer (merkulove). If no patched version is available, site administrators should consider deactivating and removing the plugin until a fix is released. Access to the WordPress admin area should be restricted to trusted users, and the principle of least privilege should be enforced for all WordPress user roles (Patchstack).