The vulnerability CVE-2025-66137 affects the merkulove Searcher for Elementor plugin up to version 1.0.3. It is a missing authorization issue where access control security levels are incorrectly configured, allowing attackers with low privileges to perform unauthorized actions. The CVSS score is 5.4 (medium), reflecting that the attack vector is network-based with low attack complexity, requiring low privileges and no user interaction. The impact includes limited confidentiality and integrity loss without affecting availability. No patch or vendor advisory is provided, and the product is not a cloud service.

An attacker with low privileges can exploit this vulnerability to bypass access controls in the Searcher for Elementor plugin, potentially leading to unauthorized disclosure or modification of data. There is no indication of availability impact or widespread exploitation. The overall impact is limited to confidentiality and integrity at a low level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin features to trusted users only and monitor for unusual activity related to the plugin. Avoid exposing the plugin to untrusted networks if possible.