CVE-2025-67588

WordPress Elementor Website Builder plugin <= 3.33.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Elementor Elementor Website Builder elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elementor Website Builder: from n/a through <= 3.33.0.

We have discovered 915,605 live websites that are affected by CVE-2025-67588.

Run a Free Instant Scan



Affected Software

Product  Elementor
Category Landing Page Builders
Vulnerable Domains915,605 live websites (35% of Elementor install base)
Vulnerable Versions
  • from 0 through 3.33
Vulnerable Versions Count301 versions ( 83% of all versions)



Details

  • Published - Dec 9, 2025
  • Updated - Apr 28, 2026

Credits

  • Bonds | Patchstack Bug Bounty Program (finder)

Website Distribution by Country

Number of websites using CVE-2025-67588
United States202,330 websites


Germany87,289 websites
France52,281 websites
Italy43,872 websites
Brazil38,861 websites
GB35,949 websites
Spain34,110 websites
Poland30,941 websites
Russia28,055 websites
Netherlands24,392 websites

Website Distribution by TLD

Number of websites using CVE-2025-67588
.com356,879 websites
.de48,756 websites
.com.br35,742 websites
.org31,769 websites
.it31,578 websites
.pl23,483 websites
.ru22,756 websites
.fr21,714 websites
.nl21,406 websites
.co.uk19,121 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2025-67588

Top websites that are affected by CVE-2025-67588. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
****.io France***
**************.de Germany***
**********.com United States*,***
********.com United States*,***
**********.com United States*,***
**.***.br Brazil*,***
******.com United States*,***
*****.com United States*,***
*****.com United States*,***
******.net United States*,***
See full domain list

FAQ

A total of 915,605 websites have been identified as vulnerable to CVE-2025-67588, based on global website indexing conducted by WebTechSurvey.
The Elementor is affected by the CVE-2025-67588 vulnerability.
Elementor versions up to and including 3.33 are vulnerable to CVE-2025-67588.