What is the CVSS score of CVE-2025-0898?

CVE-2025-0898 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Xpro Elementor Addons CVE-2025-0898

EUVD-2025-209964 MEDIUM

External Control of File Name or Path (CWE-73)

2026-05-27 security@wordfence.com

GHSA-gcxw-mc4c-r5h7

Information Disclosure WordPress

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:23 vuln.today

CVE Published

May 27, 2026 - 11:16 nvd

MEDIUM 6.5

DescriptionCVE.org

The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Arbitrary File Reading in all versions up to, and including, 1.4.7 via the Draw SVG widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

AnalysisAI

Arbitrary file read in the Xpro Elementor Addons - Pro WordPress plugin (versions ≤1.4.7) allows authenticated attackers with Contributor-level access to retrieve the contents of any file readable by the web server process, including credential-bearing files such as wp-config.php. The vulnerability originates in the Draw SVG widget, which passes user-controlled input to a server-side file read operation without adequate path restriction (CWE-73). No public exploit code has been identified at time of analysis, and CISA has not added this to the KEV catalog; however, successful exploitation fully compromises the confidentiality of server-side data.

Technical ContextAI

CWE-73 (External Control of File Name or Path) describes a class of flaws where an application uses attacker-supplied data to construct a file system path without sufficiently restricting what paths are accessible. In this case, the Draw SVG widget of the Xpro Elementor Addons - Pro plugin for WordPress accepts input that is used to locate and render an SVG file. Because the path resolution is not constrained to a safe directory (e.g., the uploads directory or plugin assets), a contributor can supply an absolute or relative path pointing to any server-readable file outside the web root - such as /etc/passwd, wp-config.php, or application configuration files containing database credentials and secret keys. The CVSS vector AV:N/AC:L/PR:L/UI:N confirms the flaw is network-exploitable with low attack complexity and requires only low-privilege (Contributor) authentication, affecting the confidentiality component fully (C:H) with no integrity or availability impact.

RemediationAI

Upgrade to a version of Xpro Elementor Addons - Pro released after 1.4.7 once available from the vendor at https://elementor.wpxpro.com/. No explicit patched version number was present in the available intelligence data, so administrators should check the plugin's changelog directly in the WordPress Plugin Directory or vendor site to confirm a remediated release before upgrading. As a compensating control, restrict Contributor-level role assignments to fully trusted users until a patch is applied, since the vulnerability requires at minimum Contributor access - revoking or auditing who holds that role directly limits the attack surface. Additionally, consider implementing a Web Application Firewall (WAF) rule to detect and block requests to the Draw SVG widget that contain path traversal sequences (e.g., '../', absolute paths beginning with '/') as a short-term mitigation, though this may interfere with legitimate SVG rendering functionality. Ensure file system permissions on sensitive files such as wp-config.php are as restrictive as possible (e.g., chmod 400) so the web server process cannot read them even if the path is correctly resolved.