The vulnerability CVE-2025-66140 affects merkulove Uper for Elementor up to version 1.0.5 and is due to missing authorization controls. This results in incorrectly configured access control security levels, allowing users with some privileges to access or modify resources beyond their intended permissions. The CVSS score is 5.4 (medium), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and limited confidentiality and integrity impacts.

An attacker with limited privileges can exploit this vulnerability to gain unauthorized access or perform unauthorized actions within the affected plugin, potentially leading to limited data disclosure or modification. There is no impact on system availability reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict user privileges to the minimum necessary and monitor for suspicious activity related to the plugin. Avoid granting elevated privileges to untrusted users in environments using affected versions.