What is the CVSS score of CVE-2025-67588?

CVE-2025-67588 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Elementor Website Builder CVE-2025-67588

Q: Which versions of Elementor Website Builder are affected by CVE-2025-67588?

Missing authorization checks in Elementor Website Builder (WordPress plugin) through version 3.33.0 allow authenticated low-privilege users to perform actions beyond their intended access level.

MEDIUM

Missing Authorization (CWE-862)

2025-12-09 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable WordPress endpoint, low-privilege auth required (PR:L), no confidentiality or availability impact, integrity-only modification within plugin scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 17:30 vuln.today

CVE Published

Dec 09, 2025 - 16:18 cve.org

MEDIUM 4.3

DescriptionCVE.org

Missing Authorization vulnerability in Elementor Elementor Website Builder elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elementor Website Builder: from n/a through <= 3.33.0.

AnalysisAI

Missing authorization checks in Elementor Website Builder (WordPress plugin) through version 3.33.0 allow authenticated low-privilege users to perform actions beyond their intended access level. Exploitation requires a valid WordPress account with low privileges (PR:L per CVSS vector), and the impact is limited to partial integrity modification with no confidentiality or availability consequences. No public exploit code or active exploitation has been identified; EPSS places this at the 14th percentile, reflecting low real-world exploitation probability.

Technical ContextAI

Elementor Website Builder is a widely-deployed WordPress page-builder plugin. The vulnerability is rooted in CWE-862 (Missing Authorization): one or more plugin endpoints or AJAX handlers fail to verify that the authenticated caller holds the requisite capability or role before executing a privileged action. WordPress plugins must explicitly call functions such as current_user_can() or validate nonces with role checks; an omission here lets any authenticated user - including subscribers or contributors - invoke functionality intended for editors or administrators. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) confirms network reachability, no complexity barrier, and restriction to authenticated callers.

Affected ProductsAI

The vulnerability affects Elementor Website Builder WordPress plugin from an unspecified earlier version through and including version 3.33.0. CPE data is not explicitly provided in the source intelligence, but the plugin is identified by its WordPress.org slug 'elementor'. The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/elementor/vulnerability/wordpress-elementor-website-builder-plugin-3-33-0-broken-access-control-vulnerability provides the canonical affected-version range.

RemediationAI

Update Elementor Website Builder to a version newer than 3.33.0; the exact patched release number is not independently confirmed from the available data beyond the boundary of the affected range. Updates can be applied via the WordPress admin dashboard under Plugins > Installed Plugins or via WP-CLI with 'wp plugin update elementor'. As a compensating control until patching is possible, site administrators should disable open user registration if it is not required (Settings > General > uncheck 'Anyone can register'), which removes the pool of low-privilege accounts that could exploit this flaw. Restricting the wp-admin and AJAX endpoint (/wp-admin/admin-ajax.php) to authenticated sessions via server-level rules (nginx or Apache) can add an additional barrier but does not eliminate risk for sites with legitimate registered users. The Patchstack advisory URL is https://patchstack.com/database/Wordpress/Plugin/elementor/vulnerability/wordpress-elementor-website-builder-plugin-3-33-0-broken-access-control-vulnerability.