The vulnerability identified as CVE-2025-66160 involves missing authorization controls in the merkulove Select Graphist for Elementor plugin (versions up to 1.2.10). This issue arises from improperly configured access control security levels, which could allow users with some privileges to access or perform actions beyond their authorization scope. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, requiring privileges, no user interaction, and limited confidentiality and integrity impact without availability impact.

The impact of this vulnerability is limited to confidentiality and integrity, with no impact on availability. Exploitation could allow an attacker with some privileges to access or modify data or functionality that should be restricted, potentially leading to unauthorized information disclosure or modification within the affected plugin's context. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations related to the Select Graphist for Elementor plugin. Limit user privileges to the minimum necessary and monitor for unusual activity related to this plugin. Avoid granting unnecessary privileges to users who can interact with this plugin.