# CVE-2025-66155: merkulove Questionar for Elementor broken access control

Source: https://junglewise.ai/threats/cve-2025-66155-merkulove-questionar-for-elementor-broken-access-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-66155 · Severity: medium · CVSS 5.4 · Published 2025-12-31

Questionar for Elementor is a WordPress plugin used to create and manage questionnaires within the Elementor page builder. A broken access control vulnerability allows unauthenticated or low-privileged users to access pages and data they should not have permission to view, potentially exposing sensitive questionnaire responses or configuration.

Vendors: [Merkulove](https://junglewise.ai/threats/vendors/merkulove).

## Quick answers

**Is CVE-2025-66155 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-66155 being exploited in the wild.

**How severe is CVE-2025-66155?** Medium severity, with a CVSS score of 5.4, published 31 December 2025.

**Which products and versions are affected?** Merkulove Questionar for Elementor <= 1.1.7.

**Is there a fix for CVE-2025-66155?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-66155 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-66155?** Check whether you run Merkulove Questionar for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a broken access control issue affecting Questionar for Elementor version 1.1.7 and earlier. The plugin fails to properly validate user permissions before allowing access to certain resources or actions. An attacker with subscriber-level privileges (or potentially unauthenticated in certain configurations) can bypass access controls to view or interact with restricted questionnaire data or pages. No official patch is currently available; users are advised to update to a newer version if available or disable the plugin until a fix is released.

## Affected products

- merkulove Questionar for Elementor <= 1.1.7

## Timeline

- 2025-11-10: disclosed: Vulnerability reported to Patchstack
- 2025-12-31: advisory: Published by Patchstack and disclosed on NVD

## References

- [https://elements.envato.com/](https://elements.envato.com/)
- [https://patchstack.com/database/Wordpress/Plugin/questionar-elementor/vulnerability/wordpress-questionar-for-elementor-plugin-1-1-7-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/Wordpress/Plugin/questionar-elementor/vulnerability/wordpress-questionar-for-elementor-plugin-1-1-7-broken-access-control-vulnerability?_s_id=cve)