What is the CVSS score of CVE-2025-68494?

CVE-2025-68494 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Premium Addons for Elementor CVE-2025-68494

MEDIUM

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

2025-12-24 audit@patchstack.com

WordPress Information Disclosure Premium Addons For Elementor Wordpress Plugin Leap13

5.3

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Attack vector network, low complexity, no privileges or interaction required; only low confidentiality impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 16:25 vuln.today

CVE Published

Dec 24, 2025 - 13:16 cve.org

MEDIUM 5.3

DescriptionCVE.org

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor allows Retrieve Embedded Sensitive Data.This issue affects Premium Addons for Elementor: from n/a through <= 4.11.53.

AnalysisAI

Sensitive information exposure in Leap13 Premium Addons for Elementor WordPress plugin up to 4.11.53 permits unauthenticated attackers to retrieve embedded sensitive data (e.g., API keys, tokens) via network requests. The flaw has a CVSS base score of 5.3 (Medium) with low confidentiality impact and no known active exploitation or public exploit code at this time.

Technical ContextAI

The vulnerability stems from CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere, where the plugin fails to properly protect embedded sensitive data from unauthorized access. As a WordPress plugin extending Elementor, it likely stores credentials or configuration details accessible via direct requests to plugin endpoints without authentication. The affected CPE cpe:2.3:a:leap13:premium_addons_for_elementor:*:*:*:*:*:wordpress:*:* covers all versions up to and including 4.11.53.

RemediationAI

Update the Premium Addons for Elementor plugin to a version newer than 4.11.53 (Patchstack advisory indicates a fix is available but does not list an exact version number). If an update is not yet available, temporarily disable the plugin or apply network-level restrictions to block unauthenticated access to its sensitive endpoints as a compensating control until a patch is applied.