CVE-2025-66156 describes a missing authorization vulnerability in merkulove Watcher for Elementor, specifically in versions up to and including 1.0.9. The flaw arises from incorrectly configured access control security levels, allowing users with some privileges (low privilege) to perform unauthorized actions. The CVSS 3.1 base score is 5.4 (medium), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, but integrity and availability impacts are present. There is no vendor advisory or patch information available at this time.

The vulnerability can lead to unauthorized modification or disruption of the affected system's integrity and availability due to missing authorization controls. Confidentiality is not impacted. The medium severity score reflects a moderate risk where attackers with limited privileges can escalate their capabilities to affect system operations. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Watcher for Elementor plugin to trusted users only and monitor for unusual activity related to privilege misuse. Avoid granting unnecessary privileges to users interacting with this plugin.