The vulnerability identified as CVE-2025-66151 affects the merkulove Countdowner for Elementor plugin (version <= 1.0.4). It is caused by missing authorization checks, which means that certain actions or resources may be accessible without proper permission verification. This incorrect access control can allow an attacker with limited privileges to perform unauthorized operations that could modify data or disrupt service availability. The CVSS 3.1 base score is 5.4, reflecting a network attack vector with low attack complexity, requiring privileges, no user interaction, and impacting integrity and availability.

Exploitation of this vulnerability could allow an attacker with some level of privileges to bypass access controls, leading to unauthorized modification of data or denial of service conditions. Confidentiality is not impacted according to the CVSS vector. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit access to the plugin's administrative functions to trusted users only and monitor for unusual activity related to the plugin. Avoid granting unnecessary privileges that could be leveraged to exploit this vulnerability.