Is CVE-2025-66145 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-66145 being exploited in the wild.

How severe is CVE-2025-66145?

Medium severity, with a CVSS score of 5.4, published 31 December 2025.

Which products and versions are affected?

Merkulove Worker for WPBakery <=1.1.1.

Is there a fix for CVE-2025-66145?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-66145 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2025-66145?

Check whether you run Merkulove Worker for WPBakery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-66145: Merkulove Worker for WPBakery broken access control

Q: Is there a fix for CVE-2025-66145?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2025-66145 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2025-66145?

Check whether you run Merkulove Worker for WPBakery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-66145 · Severity: medium · CVSS 5.4 · Published 2025-12-31

Worker for WPBakery is a WordPress plugin that integrates page building capabilities with WPBakery. A broken access control vulnerability allows authenticated users (such as subscribers) to bypass permission checks and access functionality or data they should not be able to reach, potentially including administrative features or other users' content.

Vendors: Merkulove.

Quick answers

Is CVE-2025-66145 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-66145 being exploited in the wild.
How severe is CVE-2025-66145?: Medium severity, with a CVSS score of 5.4, published 31 December 2025.
Which products and versions are affected?: Merkulove Worker for WPBakery <=1.1.1.
Is there a fix for CVE-2025-66145?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-66145 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2025-66145?: Check whether you run Merkulove Worker for WPBakery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a broken access control issue (CWE-639) in the Worker for WPBakery WordPress plugin affecting versions up to 1.1.1. An attacker with subscriber-level privileges can exploit incorrectly configured access control mechanisms to perform actions or view pages that should be restricted to higher privilege levels. The vulnerability requires authentication to the WordPress site but no additional user interaction. An exploit allows privilege escalation within the WordPress environment, potentially enabling unauthorized access to administrative functionality or sensitive data. No official patch was available as of the advisory publication date.

Affected products

Merkulove Worker for WPBakery <=1.1.1

Timeline

2025-12-31: disclosed: Published by Patchstack
2025-11-10: other: Reported by Phat RiO

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.