CVE-2025-66135: Imager for Elementor Auth Bypass Flaw

CVE-2025-66135 Overview

CVE-2025-66135 is a missing authorization vulnerability [CWE-862] in the merkulove Imager for Elementor WordPress plugin. The flaw affects all versions up to and including 2.0.4. The plugin fails to enforce proper access control checks, allowing authenticated users with low privileges to perform actions reserved for higher-privileged roles. The issue stems from incorrectly configured access control security levels on plugin endpoints. Successful exploitation can lead to limited confidentiality and integrity impact on affected WordPress sites running this Elementor add-on.

Critical Impact

Authenticated attackers with low privileges can bypass authorization controls in Imager for Elementor versions <= 2.0.4, leading to unauthorized actions affecting site confidentiality and integrity.

Affected Products

• merkulove Imager for Elementor (imager-elementor)
• All versions from n/a through 2.0.4
• WordPress sites using the affected plugin alongside Elementor

Discovery Timeline

• 2026-01-22 - CVE CVE-2025-66135 published to NVD
• 2026-04-27 - Last updated in NVD database

Technical Details for CVE-2025-66135

Vulnerability Analysis

The vulnerability is classified as Missing Authorization under [CWE-862]. The Imager for Elementor plugin exposes functionality that does not verify whether the requesting user holds the required capability or role. WordPress plugins typically rely on current_user_can() checks and nonce validation to protect sensitive actions. When these checks are absent or misconfigured, the access control boundary collapses for authenticated callers.

An attacker who already holds a low-privileged WordPress account, such as Subscriber or Contributor, can invoke plugin endpoints intended for administrators or editors. The attack is conducted over the network and requires no user interaction. Because the scope remains unchanged, the impact is bounded to the vulnerable WordPress application rather than the underlying host.

The limited confidentiality and integrity impact suggests the exposed functionality permits reading or modifying plugin-managed data, such as image configurations or Elementor widget settings, rather than full site takeover. Availability is not affected.

Root Cause

The root cause is the absence or misconfiguration of authorization checks on one or more plugin handlers. The plugin does not validate whether the authenticated session belongs to a user with the correct capability before executing privileged operations. Refer to the Patchstack Vulnerability Report for additional technical context.

Attack Vector

Exploitation requires a valid authenticated session with low privileges on the target WordPress site. The attacker sends crafted HTTP requests to plugin-controlled AJAX or REST endpoints. Because the endpoints do not validate role or capability, the server processes the request and performs the privileged action. Sites that allow open registration are at elevated risk because attackers can self-provision the required low-privilege account.

No verified public exploit code is available at the time of publication. The vulnerability is described in prose only; see the linked Patchstack advisory for endpoint-specific details.

Detection Methods for CVE-2025-66135

Indicators of Compromise

• Unexpected modifications to Elementor widget content, image assets, or plugin settings performed by non-administrator accounts.
• HTTP POST requests from low-privileged user sessions to wp-admin/admin-ajax.php or REST routes registered by the imager-elementor plugin.
• Newly registered Subscriber accounts followed shortly by requests to plugin-specific endpoints.

Detection Strategies

• Audit WordPress access logs for requests to imager-elementor plugin endpoints originating from accounts that should not have administrative privileges.
• Correlate user role data with action logs from a security plugin such as WP Activity Log to identify privilege boundary violations.
• Inspect the database for unauthorized changes to wp_options keys or postmeta entries owned by the plugin.

Monitoring Recommendations

• Enable verbose logging on WordPress AJAX and REST endpoints, capturing user ID, role, and request payload.
• Forward web server and application logs to a centralized analytics platform for behavioral baselining of authenticated user activity.
• Alert on anomalous request patterns where low-privileged users access plugin administrative routes.

How to Mitigate CVE-2025-66135

Immediate Actions Required

• Update Imager for Elementor to a version newer than 2.0.4 once the vendor releases a patched release.
• Audit existing WordPress user accounts and remove inactive or unrecognized low-privileged users.
• Disable open user registration on sites that do not require it by unchecking Anyone can register under WordPress general settings.

Patch Information

At the time of publication, the Patchstack advisory lists affected versions as n/a through 2.0.4. Monitor the Patchstack Vulnerability Report and the official plugin repository for an updated release that introduces proper capability and nonce checks.

Workarounds

• Deactivate and remove the Imager for Elementor plugin until a fixed version is available if the functionality is not business-critical.
• Apply a Web Application Firewall (WAF) rule that blocks requests to plugin endpoints from sessions associated with low-privileged roles.
• Restrict access to the WordPress admin and AJAX endpoints by IP allowlist where operationally feasible.

# Configuration example: deactivate the plugin via WP-CLI until a patch is available
wp plugin deactivate imager-elementor
wp plugin status imager-elementor