Quick answers
- Is CVE-2025-66160 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-66160 being exploited in the wild.
- How severe is CVE-2025-66160?
- Medium severity, with a CVSS score of 5.4, published 31 December 2025.
- Which products and versions are affected?
- Merkulove Graphist for Elementor through 1.2.10.
- Is there a fix for CVE-2025-66160?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2025-66160 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2025-66160?
- Check whether you run Merkulove Graphist for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a broken access control issue in Select Graphist for Elementor plugin version 1.2.10 and earlier. The plugin fails to implement proper authorization checks when handling user requests, allowing users with lower privilege levels (e.g., subscriber role) to bypass restrictions and access functionalities or data they should not be permitted to reach. This is a server-side authorization flaw without requiring network elevation or user interaction. An attacker with a low-privilege account can exploit this to view restricted pages or perform unauthorized actions. No official patch is currently available as of the advisory publication.
Affected products
- Merkulove Graphist for Elementor through 1.2.10
Timeline
- 2025-11-11: disclosed: Reported by Phat RiO
- 2025-12-31: advisory: Published by Patchstack
- 2025-12-31: advisory: Published to NVD