CVE-2025-68087: 
WordPress vulnerability analysis and mitigation

CVE-2025-68087 is a Missing Authorization (Broken Access Control) vulnerability in the Modalier for Elementor WordPress plugin developed by merkulove. It allows authenticated attackers with low privileges (Subscriber-level) to exploit incorrectly configured access control security levels. The vulnerability affects all versions of the plugin up to and including 1.0.6, and was reported by researcher Phat RiO on November 11, 2025, with public disclosure on December 11–16, 2025. It carries a CVSS v3.1 base score of 5.4 (Medium), assigned by CISA-ADP (Patchstack, NVD).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing privileged actions. An authenticated attacker with Subscriber-level access can send crafted network requests to trigger functionality that should be restricted to higher-privileged roles, exploiting the incorrectly configured access control. No complex conditions or user interaction are required for exploitation. The issue was identified and reported through Patchstack's Vulnerability Disclosure Program (Patchstack).

Successful exploitation results in limited but meaningful confidentiality and integrity impacts, with no availability impact. An authenticated low-privileged user could read or modify data they are not authorized to access within the plugin's functionality. Given the plugin's role in managing modal dialogs within Elementor-based WordPress sites, unauthorized manipulation could affect site content or configuration managed by the plugin (Patchstack, NVD).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is very low at approximately 0.017%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority, noting it is unlikely to be exploited despite the potential for use in mass-exploit campaigns targeting WordPress plugins (Patchstack).

As of the time of disclosure, no official patched version of the Modalier for Elementor plugin was available — the Patchstack advisory notes "No official patch available" for versions up to and including 1.0.6. Site administrators should monitor the WordPress plugin repository for an updated version and apply it as soon as one is released. In the interim, disabling or removing the plugin is the most effective workaround. Restricting Subscriber-level user registration on the affected WordPress site can also reduce the attack surface (Patchstack).