What is the CVSS score of CVE-2025-66156?

CVE-2025-66156 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-66156

MEDIUM

Missing Authorization (CWE-862)

2025-12-31 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

5.4 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 31, 2025 - 17:15 nvd

N/A

DescriptionCVE.org

Missing Authorization vulnerability in merkulove Watcher for Elementor watcher-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Watcher for Elementor: from n/a through <= 1.0.9.

AnalysisAI

Missing authorization in merkulove Watcher for Elementor plugin (versions up to 1.0.9) allows unauthenticated attackers to bypass access controls and exploit incorrectly configured security levels, potentially enabling unauthorized access to sensitive functionality or data. The vulnerability carries an EPSS score of 0.02% (percentile 4%), indicating very low observed exploitation probability, with no public exploit code or active exploitation confirmed at the time of analysis.

Technical ContextAI

This vulnerability stems from improper implementation of access control checks in the Watcher for Elementor WordPress plugin, classified under CWE-862 (Missing Authorization). The plugin fails to enforce proper authentication and authorization mechanisms when handling requests, allowing attackers to bypass intended security restrictions. WordPress plugins that integrate with Elementor page builder are particularly sensitive to access control flaws, as they often interact with page creation, editing, and user role management functions. The root cause is the absence of adequate capability checks or permission validation before allowing sensitive operations.

Affected ProductsAI

The vulnerability affects merkulove Watcher for Elementor WordPress plugin versions up to and including 1.0.9. The plugin is available on the WordPress Plugin Directory and is identified by the slug 'watcher-elementor'. All installations running version 1.0.9 or earlier are affected by this missing authorization flaw.

RemediationAI

Update merkulove Watcher for Elementor to a version newer than 1.0.9 immediately. Users should navigate to their WordPress dashboard, locate the Watcher for Elementor plugin in the Plugins section, and apply the available update. Consult the plugin's changelog and the Patchstack vulnerability database (https://patchstack.com/database/Wordpress/Plugin/watcher-elementor/vulnerability/wordpress-watcher-for-elementor-plugin-1-0-9-broken-access-control-vulnerability) for confirmation of the patched version. As a temporary measure pending update availability, site administrators should restrict access to the plugin's functionality through WordPress user role management until a patched version is available.