CVE-2025-67588: WordPress Elementor Website Builder plugin <= 3.33.0 - Broken Access Control vulnerability
Published Dec 9, 2025
·Updated
Missing Authorization vulnerability in Elementor Elementor Website Builder elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elementor Website Builder: from n/a through <= 3.33.0.
Affected Software
1 affected component
wordpress/elementor<=3.33.0
Event History
Dec 9, 2025
CVE Published
via MITRE·02:14 PM
Data Sourced
via MITRE·02:14 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-67588?
CVE-2025-67588 is categorized as a critical missing authorization vulnerability in Elementor Website Builder.
2
How do I fix CVE-2025-67588?
To fix CVE-2025-67588, update Elementor Website Builder to the latest version beyond 3.33.0.
3
What versions of Elementor are affected by CVE-2025-67588?
CVE-2025-67588 affects Elementor Website Builder versions up to and including 3.33.0.
4
What type of vulnerability is CVE-2025-67588?
CVE-2025-67588 is a missing authorization vulnerability related to incorrectly configured access control.
5
What could happen if I don't address CVE-2025-67588?
Failure to address CVE-2025-67588 could allow unauthorized access to restricted features within your Elementor website.