CVE-2025-66154 describes a Missing Authorization vulnerability in the merkulove Couponer for Elementor plugin (versions up to 1.1.7). This vulnerability arises from incorrectly configured access control, allowing users with limited privileges to perform unauthorized actions. The CVSS 3.1 base score is 5.4 (medium), with network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact. No patch or official remediation is currently documented. The vulnerability is not known to be exploited in the wild.

The vulnerability allows unauthorized actions due to missing authorization checks, which can lead to limited integrity and availability impacts within the affected plugin. There is no confidentiality impact reported. The medium severity score reflects that an attacker with low privileges could exploit this remotely without user interaction to cause some disruption or unauthorized changes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently documented, users should monitor merkulove's official channels for updates. Until a fix is available, consider restricting access to the plugin's functionality to trusted users only and review user permissions carefully to minimize risk.