EUVD-2025-209964
GHSA-gcxw-mc4c-r5h7
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionNVD
The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Arbitrary File Reading in all versions up to, and including, 1.4.7 via the Draw SVG widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
AnalysisAI
Arbitrary file read in the Xpro Elementor Addons - Pro WordPress plugin (versions ≤1.4.7) allows authenticated attackers with Contributor-level access to retrieve the contents of any file readable by the web server process, including credential-bearing files such as wp-config.php. The vulnerability originates in the Draw SVG widget, which passes user-controlled input to a server-side file read operation without adequate path restriction (CWE-73). No public exploit code has been identified at time of analysis, and CISA has not added this to the KEV catalog; however, successful exploitation fully compromises the confidentiality of server-side data.
Technical ContextAI
CWE-73 (External Control of File Name or Path) describes a class of flaws where an application uses attacker-supplied data to construct a file system path without sufficiently restricting what paths are accessible. In this case, the Draw SVG widget of the Xpro Elementor Addons - Pro plugin for WordPress accepts input that is used to locate and render an SVG file. Because the path resolution is not constrained to a safe directory (e.g., the uploads directory or plugin assets), a contributor can supply an absolute or relative path pointing to any server-readable file outside the web root - such as /etc/passwd, wp-config.php, or application configuration files containing database credentials and secret keys. The CVSS vector AV:N/AC:L/PR:L/UI:N confirms the flaw is network-exploitable with low attack complexity and requires only low-privilege (Contributor) authentication, affecting the confidentiality component fully (C:H) with no integrity or availability impact.
RemediationAI
Upgrade to a version of Xpro Elementor Addons - Pro released after 1.4.7 once available from the vendor at https://elementor.wpxpro.com/. No explicit patched version number was present in the available intelligence data, so administrators should check the plugin's changelog directly in the WordPress Plugin Directory or vendor site to confirm a remediated release before upgrading. As a compensating control, restrict Contributor-level role assignments to fully trusted users until a patch is applied, since the vulnerability requires at minimum Contributor access - revoking or auditing who holds that role directly limits the attack surface. Additionally, consider implementing a Web Application Firewall (WAF) rule to detect and block requests to the Draw SVG widget that contain path traversal sequences (e.g., '../', absolute paths beginning with '/') as a short-term mitigation, though this may interfere with legitimate SVG rendering functionality. Ensure file system permissions on sensitive files such as wp-config.php are as restrictive as possible (e.g., chmod 400) so the web server process cannot read them even if the path is correctly resolved.
More from same product – last 7 days
Unauthenticated refund abuse in the Eupago Gateway for WooCommerce WordPress plugin before 4.7.2 lets remote attackers t
Authentication bypass in the Login with OTP plugin for WordPress (all versions up to and including 1.6) lets unauthentic
Blind SQL injection in the RealMag777 'Active Products Tables for WooCommerce' WordPress plugin (versions up to and incl
Blind SQL injection in the RealMag777 "Active Products Tables for WooCommerce" WordPress plugin (all versions up to and
Remote code execution in the WPCode WordPress plugin (versions through 2.3.5) lets authenticated author-level users run
Share
External POC / Exploit Code
Leaving vuln.today