The vulnerability identified as CVE-2025-66161 affects the merkulove Grider for Elementor plugin through version 1.0.8. It involves missing authorization checks, meaning that the plugin does not properly enforce access control security levels. This can allow users with limited privileges to perform actions or access data beyond their intended permissions. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial confidentiality and integrity impact without availability impact.

Successful exploitation could allow an attacker with some privileges to bypass intended access controls, leading to limited unauthorized disclosure or modification of data within the affected plugin. There is no indication of availability impact or complete system compromise. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. Restricting user privileges to the minimum necessary may reduce risk but does not fully mitigate the vulnerability.