The vulnerability identified as CVE-2025-66158 affects the merkulove Gmaper for Elementor plugin (versions up to 1.0.9). It is caused by missing authorization checks, resulting in incorrectly configured access control security levels. This allows an attacker with low privileges to perform unauthorized actions that could impact the integrity and availability of the affected system. The CVSS v3.1 base score is 5.4, reflecting a network attack vector with low attack complexity, requiring privileges but no user interaction, and impacting integrity and availability without confidentiality loss. No patch or vendor advisory is currently available to confirm remediation status.

The vulnerability can lead to unauthorized modification or disruption of the plugin's functionality due to missing authorization controls. While confidentiality is not affected, integrity and availability impacts are possible. There are no reports of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and restrict user privileges to minimize exposure to this vulnerability. Monitor for updates from merkulove regarding patches or official mitigation steps.