CVE-2025-66139 describes a missing authorization vulnerability in the merkulove Audier For Elementor plugin, affecting versions up to and including 1.0.9. The flaw arises from incorrectly configured access control security levels, allowing users with limited privileges to bypass intended restrictions. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity, with network attack vector, low attack complexity, privileges required, no user interaction, and impacts on confidentiality and integrity. No patch or vendor advisory is provided, and the product is not a cloud service.

The vulnerability could allow an attacker with some privileges to access or modify data beyond their authorization, potentially leading to partial confidentiality and integrity breaches. There is no impact on availability. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user privileges to the minimum necessary and monitor for unusual activity related to the plugin. Avoid granting elevated privileges to untrusted users.