Is CVE-2025-66152 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-66152 being exploited in the wild.

How severe is CVE-2025-66152?

Medium severity, with a CVSS score of 5.4, published 31 December 2025.

Which products and versions are affected?

Merkulove Criptopayer for Elementor <= 1.0.1.

Is there a fix for CVE-2025-66152?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-66152 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2025-66152?

Check whether you run Merkulove Criptopayer for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-66152: merkulove Criptopayer for Elementor broken access control

Q: Is there a fix for CVE-2025-66152?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2025-66152 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2025-66152?

Check whether you run Merkulove Criptopayer for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-66152 · Severity: medium · CVSS 5.4 · Published 2025-12-31

Criptopayer for Elementor is a WordPress plugin that integrates cryptocurrency payment processing with the Elementor page builder. A broken access control flaw allows authenticated subscribers to access or modify pages and data they should not have permission to reach, potentially exposing customer payment information or sensitive site content.

Vendors: Merkulove.

Quick answers

Is CVE-2025-66152 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-66152 being exploited in the wild.
How severe is CVE-2025-66152?: Medium severity, with a CVSS score of 5.4, published 31 December 2025.
Which products and versions are affected?: Merkulove Criptopayer for Elementor <= 1.0.1.
Is there a fix for CVE-2025-66152?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-66152 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2025-66152?: Check whether you run Merkulove Criptopayer for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a broken access control vulnerability affecting Criptopayer for Elementor versions up to 1.0.1. The plugin fails to properly enforce authorization checks, allowing users with the Subscriber privilege level to access restricted functionality or data. An authenticated attacker with a subscriber account can bypass access controls to view or perform actions intended only for higher-privilege users. The vulnerability requires an existing WordPress account, limiting exploitability but remaining a material risk for multi-user sites. No official patch is currently available.

Affected products

merkulove Criptopayer for Elementor <= 1.0.1

Timeline

2025-11-10: disclosed: Reported by Phat RiO
2025-12-31: advisory: Published by Patchstack

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.