The vulnerability identified as CVE-2025-68088 concerns an incorrect access control configuration in the merkulove Huger for Elementor plugin (versions ≤ 1.1.5). Specifically, it is a missing authorization issue that permits users with limited privileges to perform actions or access resources that should require higher authorization. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction needed, and impacts confidentiality and integrity with no availability impact.

Exploitation of this vulnerability could allow an attacker with low privileges to access or modify data beyond their authorization level, potentially compromising confidentiality and integrity of the affected system. There is no indication of availability impact or widespread exploitation at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for unusual activity related to privilege escalation attempts.