CVE-2025-14155
published 2025-12-23CVE-2025-14155: The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data due to a missing…
PriorityP179medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
0.71%
49.1th percentile
The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_template_content' function in all versions up to, and including, 4.11.53. This makes it possible for unauthenticated attackers to view the content of private, draft, and pending templates.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| leap13 | premium_addons_for_elementor | < 4.11.54 | 4.11.54 |
| leap13 | premium_addons_for_elementor_powerful_elementor_templates_widgets | <= 4.11.53 | — |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cm1_pcre_8.44-1_on_cbl_mariner_1.0 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
url/wp-admin/admin-ajax.php?action=get_elementor_template_content&templateID={{template_id}}&is_id=true↗
- →Detect unauthenticated GET requests to admin-ajax.php with action=get_elementor_template_content and is_id=true parameter — the core exploit pattern for this CVE. ↗
- →Successful exploitation returns a JSON response body containing both '"success":true' and '"template_content"' with HTTP 200 and Content-Type application/json — use these as confirmation matchers. ↗
- →The vulnerable AJAX handler is get_template_content() / get_elementor_template_content — monitor WordPress AJAX logs for unauthenticated calls to this action. ↗
- →Requests include the X-Requested-With: XMLHttpRequest header — correlate this with unauthenticated sessions hitting admin-ajax.php for the specific action. ↗
- ·The Nuclei template uses a randomized templateID (rand_int 1–100); real attackers may enumerate a wider range of IDs to maximize template content disclosure. Detection rules should not be limited to this range. ↗
- ·All versions up to and including 4.11.53 are vulnerable; the fix is present in versions beyond 4.11.53. Ensure version-based detection/blocking covers the full affected range. ↗
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
vulncheck5.3MEDIUM
vendor_msrc5.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-8689-6x46-8697: The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data due to a m
ghsa_unreviewed·2025-12-23
CVE-2025-14155 [MEDIUM] CWE-862 GHSA-8689-6x46-8697: The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data due to a m
The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_template_content' function in all versions up to, and including, 4.11.53. This makes it possible for unauthenticated attackers to view the content of private, draft, and pending templates.
VulnCheck
leap13 premium_addons_for_elementor Missing Authorization
vulncheck·2025·CVSS 5.3
CVE-2025-14155 [MEDIUM] leap13 premium_addons_for_elementor Missing Authorization
leap13 premium_addons_for_elementor Missing Authorization
The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_template_content' function in all versions up to, and including, 4.11.53. This makes it possible for unauthenticated attackers to view the content of private, draft, and pending templates.
Affected: leap13 premium_addons_for_elementor
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://tracker.crowdsec.net/cves/CVE-2025-14155
Microsoft
libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.
vendor_msrc·2020-06-09·CVSS 5.3
CVE-2020-14155 [MEDIUM] CWE-190 libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.
libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
mitre: mitre
Customer Action Required: Yes
Remediation: CBL-M
No detection rules found.
Nuclei
Premium Addons for Elementor - Unauthenticated Information Disclosure
nuclei·CVSS 5.3
CVE-2025-14155 [MEDIUM] Premium Addons for Elementor - Unauthenticated Information Disclosure
Premium Addons for Elementor - Unauthenticated Information Disclosure
Premium Addons for Elementor plugin for WordPress version 4.11.53 and below contains an unauthenticated information disclosure vulnerability.The vulnerability exists due to a missing authorization check in the get_template_content() AJAX handler, allowing unauthenticated attackers to retrieve private, draft, and pending Elementor templates that may contain sensitive information such as API keys, credentials, customer data,or unpublished content.
Template:
id: CVE-2025-14155
info:
name: Premium Addons for Elementor - Unauthenticated Information Disclosure
author: DhiyaneshDk
severity: medium
description: |
Premium Addons for Elementor plugin for WordPress version 4.11.53 and below contains an unauthenticated informati
https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/tags/4.11.53/includes/addons-integration.php#L1624https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/tags/4.11.53/includes/addons-integration.php#L90https://plugins.trac.wordpress.org/changeset/3416254/https://research.cleantalk.org/cve-2025-14155/https://www.wordfence.com/threat-intel/vulnerabilities/id/135c33bb-5ec2-4697-9340-1d2651ff3a0b?source=cve
2025-12-23
Published
Exploited in the wild