EUVD-2025-209902
GHSA-wfj4-gg7v-ph8q
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
1DescriptionNVD
The Xpro Addons - 140+ Widgets for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the get_content_editor function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to create published Xpro templates.
AnalysisAI
Unauthorized template creation in the Xpro Addons for Elementor WordPress plugin exposes sites to unauthenticated content injection via a missing capability check on the get_content_editor AJAX function. All plugin versions through 1.5.0 are affected, allowing any remote attacker without credentials to create and publish Xpro templates on targeted WordPress sites. No public exploit identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial remote exploitability against default installations with no preconditions.
Technical ContextAI
CWE-862 (Missing Authorization) describes the root cause: the get_content_editor function in the Xpro Addons plugin executes privileged template-creation logic without invoking WordPress capability checks such as current_user_can(). In WordPress, AJAX handlers registered without nonce verification and capability gating are accessible to unauthenticated requests by default. The affected product is identified by CPE cpe:2.3:a:xpro:xpro_addons_-_140+_widgets_for_elementor:*:*:*:*:*:*:*:* - a widely-used Elementor addon bundle. The Elementor template system allows creation of reusable page layouts, meaning unauthorized published templates could be served to site visitors or used as a staging ground for further content manipulation.
RemediationAI
Apply the upstream fix committed to the Xpro Elementor Addons plugin SVN repository at revision 3508547, referenced at https://plugins.trac.wordpress.org/browser/xpro-elementor-addons/trunk?rev=3508547. A specific released patch version number is not independently confirmed in available data - verify via the WordPress plugin repository that a version newer than 1.5.0 is available and update immediately. As a compensating control while awaiting a confirmed patched release, site administrators can restrict access to WordPress AJAX endpoints (wp-admin/admin-ajax.php) for unauthenticated users via WAF rules or by using a security plugin such as Wordfence to block requests invoking get_content_editor without authentication. Note that blanket AJAX blocking may break other plugin functionality and should be tested in a staging environment first.
More from same product – last 7 days
Unauthenticated refund abuse in the Eupago Gateway for WooCommerce WordPress plugin before 4.7.2 lets remote attackers t
Authentication bypass in the Login with OTP plugin for WordPress (all versions up to and including 1.6) lets unauthentic
Blind SQL injection in the RealMag777 'Active Products Tables for WooCommerce' WordPress plugin (versions up to and incl
Blind SQL injection in the RealMag777 "Active Products Tables for WooCommerce" WordPress plugin (all versions up to and
Remote code execution in the WPCode WordPress plugin (versions through 2.3.5) lets authenticated author-level users run
Share
External POC / Exploit Code
Leaving vuln.today