Quick answers
- Is CVE-2025-66148 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-66148 being exploited in the wild.
- How severe is CVE-2025-66148?
- Medium severity, with a CVSS score of 5.4, published 31 December 2025.
- Which products and versions are affected?
- Merkulove Conformer for Elementor up to 1.0.7.
- Is there a fix for CVE-2025-66148?
- A patch was published on 2025-12-31: Version 1.0.8 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-66148 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2025-66148?
- Check whether you run Merkulove Conformer for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a broken access control flaw in Conformer for Elementor versions up to 1.0.7, allowing users with subscriber-level privileges to bypass authorization checks and access or perform actions restricted to higher-privilege roles. The vulnerability affects functionality related to form access and data visibility. An attacker with a valid WordPress subscriber account can exploit this without additional preconditions. The fix is available in version 1.0.8 and later.
Affected products
- merkulove Conformer for Elementor up to 1.0.7
Timeline
- 2025-11-10: disclosed: Reported to Patchstack
- 2025-12-31: patched: Version 1.0.8 released
- 2025-12-31: advisory: Published on Patchstack