What is the CVSS score of CVE-2025-66158?

CVE-2025-66158 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-66158

MEDIUM

Missing Authorization (CWE-862)

2025-12-31 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

5.4 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 31, 2025 - 17:15 nvd

N/A

DescriptionCVE.org

Missing Authorization vulnerability in merkulove Gmaper for Elementor gmaper-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gmaper for Elementor: from n/a through <= 1.0.9.

AnalysisAI

Gmaper for Elementor plugin versions up to 1.0.9 contains a missing authorization vulnerability (CWE-862) that allows attackers to exploit incorrectly configured access control security levels, potentially bypassing authentication mechanisms to access restricted functionality. The vulnerability carries a 0.02% EPSS score (percentile 4%), indicating minimal real-world exploitation risk at present, with no public exploit code or active exploitation currently identified.

Technical ContextAI

Gmaper for Elementor is a WordPress plugin that integrates Google Maps functionality with the Elementor page builder. The vulnerability stems from CWE-862 (Missing Authorization), a class of security flaw where access control checks are either absent or improperly implemented at the application layer. This typically means the plugin fails to verify user capabilities or roles before granting access to sensitive actions, API endpoints, or administrative functions. The root cause involves incorrectly configured access control security levels, which in the WordPress ecosystem usually manifests as missing capability checks (wp_verify_nonce failures, missing current_user_can() calls, or improper nonce validation) in AJAX handlers or REST endpoints exposed by the plugin.

Affected ProductsAI

Gmaper for Elementor is affected from version n/a through 1.0.9. The vulnerability is cataloged in the Patchstack WordPress plugin vulnerability database (CPE and exact product identifiers not provided in input). Users running any version of the plugin up to and including version 1.0.9 are potentially affected. The plugin integrates with Elementor page builder and WordPress installations.

RemediationAI

Users should upgrade Gmaper for Elementor to a version newer than 1.0.9 as soon as a patched release is available. Check the official plugin repository or vendor advisory at https://patchstack.com/database/Wordpress/Plugin/gmaper-elementor/vulnerability/wordpress-gmaper-for-elementor-plugin-1-0-9-broken-access-control-vulnerability for patch availability and updated version information. In the interim, site administrators should review and restrict user roles and capabilities in WordPress to minimize exposure; disable the plugin if it is not actively in use, and monitor access logs for unauthorized API or administrative action attempts related to Gmaper functionality.