The vulnerability identified as CVE-2025-66166 affects merkulove Lottier for Elementor plugin versions up to 1.0.9. It is caused by missing authorization checks, which result in incorrectly configured access control security levels. This allows attackers with low privileges to perform actions or access data beyond their intended permissions. The CVSS v3.1 base score is 5.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impact on confidentiality and integrity, with no impact on availability.

Exploitation of this vulnerability could allow an attacker with limited privileges to bypass access controls, potentially leading to unauthorized disclosure or modification of data within the affected plugin. There is no indication of impact on system availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin features to trusted users only and monitor for unusual activity related to the plugin. Avoid granting unnecessary privileges to users who can interact with the affected plugin.