CVE-2025-66165 describes a missing authorization vulnerability in the merkulove Lottier for WPBakery plugin up to version 1.1.7. The flaw arises from incorrectly configured access control security levels, allowing users with limited privileges to potentially perform unauthorized actions. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges are low, no user interaction needed, unchanged scope, and low impact on confidentiality and integrity, with no impact on availability. No patch or vendor advisory is currently provided, and no exploits are known in the wild.

The vulnerability could allow an attacker with low privileges to access or modify data beyond their authorization level, potentially leading to limited confidentiality and integrity breaches. There is no impact on system availability. Since no exploits are known, the practical impact may be limited until further information emerges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user privileges to the minimum necessary and monitor for unusual activity related to the Lottier for WPBakery plugin. Avoid granting unnecessary access rights that could be exploited due to this missing authorization issue.