What is the CVSS score of CVE-2025-66152?

CVE-2025-66152 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

Wordpress Plugin CVE-2025-66152

MEDIUM

Missing Authorization (CWE-862)

2025-12-31 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

5.4 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 31, 2025 - 19:15 nvd

N/A

DescriptionCVE.org

Missing Authorization vulnerability in merkulove Criptopayer for Elementor criptopayer-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Criptopayer for Elementor: from n/a through <= 1.0.1.

AnalysisAI

Criptopayer for Elementor WordPress plugin through version 1.0.1 contains a missing authorization vulnerability allowing unauthenticated attackers to exploit incorrectly configured access control security levels and bypass authentication mechanisms. The vulnerability stems from insufficient validation of user permissions, enabling unauthorized access to sensitive plugin functionality. With an EPSS score of 0.05% (17th percentile), real-world exploitation probability is currently low, and no active exploitation or public proof-of-concept code has been reported.

Technical ContextAI

This is a CWE-862 (Missing Authorization) vulnerability in a WordPress plugin for Elementor, a page builder platform. The vulnerability arises from the plugin's failure to properly implement access control checks before allowing users to execute privileged actions or access restricted resources. WordPress plugins typically handle authorization through capabilities and roles; this plugin appears to expose sensitive functionality without verifying the current user's permissions, allowing any visitor (authenticated or not, depending on the specific endpoint) to interact with protected features. The plugin integrates cryptocurrency payment processing via the Criptopayer service, making unauthorized access to payment-related functions a significant concern.

Affected ProductsAI

Criptopayer for Elementor WordPress plugin version 1.0.1 and all earlier versions are affected. The plugin is identified by the CPE implicit reference in the advisory as the WordPress plugin 'criptopayer-elementor'. Affected installations include any WordPress site running this plugin up to and including version 1.0.1.

RemediationAI

Update Criptopayer for Elementor to a patched version beyond 1.0.1 as soon as it becomes available. Check the plugin repository or vendor advisory at https://patchstack.com/database/Wordpress/Plugin/criptopayer-elementor/vulnerability/wordpress-criptopayer-for-elementor-plugin-1-0-1-broken-access-control-vulnerability for the latest fixed release. If a patched version is not yet released, consider disabling the plugin or restricting access via WordPress user roles and network firewalls until an update is available. Ensure that any cryptocurrency payment integrations are reviewed for unauthorized access by monitoring payment logs and transaction history.