CVE-2025-12778: 
WordPress vulnerability analysis and mitigation

CVE-2025-12778 is a missing authorization vulnerability in the Ultimate Member Widgets for Elementor – WordPress User Directory plugin for WordPress. It allows unauthenticated remote attackers to extract partial user metadata from all WordPress users on affected sites. All plugin versions up to and including 2.3 are affected. The vulnerability was published on November 20, 2025, and carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is a missing capability check (CWE-862) on the handle_filter_users function within the plugin. Because no authentication or authorization gate is enforced before this function executes, any unauthenticated network request can invoke it and receive user metadata in response. The attack vector is purely network-based, requires no user interaction, low complexity, and no privileges, making it trivially exploitable against any exposed WordPress installation running the vulnerable plugin version (Wordfence).

Successful exploitation allows unauthenticated attackers to enumerate partial metadata for all WordPress users on the affected site, including first names, last names, and email addresses. This data exposure can facilitate follow-on attacks such as targeted phishing, credential stuffing, or social engineering campaigns. There is no integrity or availability impact; the risk is limited to confidentiality of user directory information (Wordfence).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-12778. The EPSS score is approximately 0.035%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Despite the low exploitation probability, the zero-authentication requirement makes it accessible to any attacker who can reach the WordPress site (Feedly).

1. Reconnaissance: Identify WordPress sites running the "Ultimate Member Widgets for Elementor" plugin (version ≤ 2.3) using tools like WPScan, Shodan, or by inspecting publicly accessible plugin asset paths (e.g., /wp-content/plugins/ultimate-member-widgets-for-elementor/).
2. Locate the vulnerable endpoint: Identify the AJAX action or REST endpoint that maps to the handle_filter_users function — typically registered via WordPress's wp_ajax_nopriv_ hook, making it accessible without authentication.
3. Send unauthenticated request: Craft an HTTP POST request to wp-admin/admin-ajax.php (or the relevant REST route) with the appropriate action parameter targeting handle_filter_users, without any authentication cookies or nonce.
4. Harvest user metadata: Parse the JSON response, which returns partial user metadata (first name, last name, email address) for WordPress users registered on the site.
5. Leverage harvested data: Use the collected email addresses and names for phishing campaigns, credential stuffing, or further targeted attacks against the site's users (Wordfence).

• Network: Repeated unauthenticated POST requests to wp-admin/admin-ajax.php with an action parameter referencing handle_filter_users or related user-filter actions from a single or rotating IP address.
• Logs: WordPress access logs showing high-frequency requests to admin-ajax.php without session cookies or authentication headers, particularly from automated tools (unusual User-Agent strings, rapid sequential requests).
• Logs: Server-side logs showing bulk enumeration patterns — many requests in short succession returning user data payloads.
• Network: Outbound data transfers or scraping patterns correlating with the timing of the above requests, suggesting automated harvesting of the response data.

The vulnerability was patched in the plugin changeset 3397029, which adds the missing capability check to the handle_filter_users function. Site administrators should update the Ultimate Member Widgets for Elementor plugin to version 2.4 or later immediately. As a temporary workaround, administrators can deactivate the plugin until the update can be applied, or use a Web Application Firewall (WAF) rule to block unauthenticated requests to the vulnerable AJAX action (Wordfence, WordPress Trac).

The vulnerability was discovered and reported by Wordfence, which published the advisory on November 20, 2025. No significant broader media coverage or notable researcher commentary beyond the initial Wordfence disclosure has been identified. Community reaction has been minimal, consistent with the medium severity rating and limited exploitation potential (Wordfence).