CVE-2025-66155

Vulnerability

Overview

The Questionar for Elementor WordPress plugin (versions up to and up to 1.1.7) contains a Missing Authorization vulnerability, classified as a Broken Access Control issue. This means the plugin fails to properly verify that a user has the necessary permissions before executing certain functions or accessing protected resources [1].

Exploitation

Attackers can exploit this incorrectly configured access control by sending crafted requests to the vulnerable endpoints without needing any authentication or elevated privileges. The vulnerability is particularly concerning because it can be leveraged in mass-exploit campaigns targeting thousands of WordPress sites simultaneously, regardless of their traffic or popularity [1]. /a].

Impact

Successful exploitation allows an unprivileged user (or an unauthenticated remote attacker) to perform actions that should only be available to higher-privileged roles, such as administrators. This could lead to unauthorized modification of plugin settings, data exposure, or further compromise of the WordPress installation [1].

Mitigation

The vendor has not released a patch beyond version 1.1.7; affected users should immediately update the plugin to the latest available version. If updating is not possible, it is recommended to contact a hosting provider or your hosting provider or web developer for assistance or to disable the plugin until a fix is deployed [1].