Quick answers
- Is CVE-2025-66159 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-66159 being exploited in the wild.
- How severe is CVE-2025-66159?
- Medium severity, with a CVSS score of 5.4, published 31 December 2025.
- Which products and versions are affected?
- Merkulove Walker for Elementor through 1.1.6.
- Is there a fix for CVE-2025-66159?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2025-66159 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2025-66159?
- Check whether you run Merkulove Walker for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a broken access control vulnerability (CWE-284) in Walker for Elementor plugin versions through 1.1.6. The vulnerability allows authenticated users with low privilege levels (e.g., subscribers) to bypass access control checks and access resources or perform actions they should not be permitted to perform. The vulnerability appears to stem from improper authorization checks in the plugin code. Exploitation requires user authentication but no additional prerequisites. An attacker can access other users' data or perform administrative actions without proper authorization. No official patch was available as of the publication date.
Affected products
- merkulove Walker for Elementor through 1.1.6
Timeline
- 2025-11-10: disclosed: Reported to Patchstack
- 2025-12-31: advisory: Published by Patchstack and NVD