# CVE-2025-66146: merkulove Logger for Elementor broken access control

Source: https://junglewise.ai/threats/cve-2025-66146-merkulove-logger-for-elementor-broken-access-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-66146 · Severity: medium · CVSS 5.4 · Published 2025-12-31

Logger for Elementor is a WordPress plugin used to add event logging capabilities to Elementor page builder sites. A broken access control vulnerability allows users with low privileges (such as Subscribers) to access or perform actions they should not be authorized for, potentially exposing sensitive data or functionality within the site.

Vendors: [Merkulove](https://junglewise.ai/threats/vendors/merkulove).

## Quick answers

**Is CVE-2025-66146 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-66146 being exploited in the wild.

**How severe is CVE-2025-66146?** Medium severity, with a CVSS score of 5.4, published 31 December 2025.

**Which products and versions are affected?** Merkulove Logger for Elementor through 1.0.9.

**Is there a fix for CVE-2025-66146?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-66146 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-66146?** Check whether you run Merkulove Logger for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a broken access control issue (OWASP A1) in the Logger for Elementor WordPress plugin affecting versions through 1.0.9. The vulnerability allows authenticated users with Subscriber-level privileges to bypass authorization checks and access functionality or data restricted to higher-privilege roles. The attack requires authentication but no special network access or user interaction beyond the user's normal access to the WordPress site. An attacker can view other users' data or trigger actions outside their intended permission scope. No official patch is currently available as of the advisory publication date.

## Affected products

- merkulove Logger for Elementor through 1.0.9

## Timeline

- 2025-11-10: disclosed: Vulnerability reported to Patchstack
- 2025-12-31: advisory: Published by Patchstack and NVD

## References

- [https://elements.envato.com/](https://elements.envato.com/)
- [https://patchstack.com/database/Wordpress/Plugin/logger-elementor/vulnerability/wordpress-logger-for-elementor-plugin-1-0-9-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/Wordpress/Plugin/logger-elementor/vulnerability/wordpress-logger-for-elementor-plugin-1-0-9-broken-access-control-vulnerability?_s_id=cve)