The vulnerability CVE-2025-66167 affects the merkulove Lottier plugin (version <= 1.1.1) and is characterized by missing authorization checks. This results in incorrectly configured access control, which could be exploited by an attacker with low privileges to gain unauthorized read or write access to certain functionalities or data. The CVSS vector indicates network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, and low impact on confidentiality and integrity, with no impact on availability.

An attacker with low privileges could exploit this missing authorization vulnerability to access or modify data or functions they should not be authorized to use. The impact is limited to low confidentiality and integrity loss, with no availability impact. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restrict access to the affected plugin and limit user privileges where possible to reduce risk.