CVE-2025-13215: 
WordPress vulnerability analysis and mitigation

CVE-2025-13215 is an Information Exposure vulnerability in the "Shortcodes and extra features for Phlox theme" plugin for WordPress, affecting all versions up to and including 2.17.13. The flaw allows unauthenticated attackers to extract titles of draft posts via the auxels_ajax_search AJAX endpoint due to insufficient post-type restrictions. It was published on January 6, 2026, and was reported by Wordfence. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The vulnerable code resides in the auxels_ajax_search handler within public/includes/frontend-ajax.php (around line 348), which performs post searches without adequately filtering out non-public post statuses such as draft. An unauthenticated attacker can send a crafted HTTP request to this AJAX endpoint to query the WordPress database and receive draft post titles in the response, bypassing WordPress's standard access controls for unpublished content (Wordfence, Plugin Source).

Successful exploitation allows any unauthenticated remote attacker to enumerate the titles of draft posts on affected WordPress sites, potentially exposing sensitive or unreleased content, editorial plans, or confidential information intended to remain private. The impact is limited to confidentiality — there is no integrity or availability impact — and exploitation does not grant code execution or administrative access. However, leaked draft titles could assist attackers in further reconnaissance or social engineering efforts (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13215. The EPSS score is approximately 0.038%, indicating a low probability of exploitation in the near term. The vulnerability requires no authentication, no user interaction, and no special privileges, making it trivially exploitable by any remote attacker against unpatched sites. It has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Reconnaissance: Identify WordPress sites using the "Shortcodes and extra features for Phlox theme" plugin (auxin-elements) version ≤ 2.17.13 via passive fingerprinting (e.g., checking /wp-content/plugins/auxin-elements/ for plugin presence).
2. Craft AJAX request: Send an unauthenticated HTTP POST or GET request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter set to auxels_ajax_search and a search query string.
3. Extract draft titles: Parse the JSON response returned by the endpoint, which may include titles of draft posts that should not be publicly accessible.
4. Enumerate further: Repeat with varied search terms to enumerate additional draft post titles for reconnaissance or intelligence gathering (Wordfence, Plugin Source).

• Network: Unusual or repeated unauthenticated HTTP requests to /wp-admin/admin-ajax.php with the parameter action=auxels_ajax_search from a single or rotating IP address.
• Logs: WordPress access logs showing high-frequency requests to the AJAX endpoint without a valid session cookie or nonce, particularly with varied search query parameters.
• Logs: Requests originating from automated tools (e.g., unusual User-Agent strings, high request rates) targeting the auxels_ajax_search action.

Users should update the "Shortcodes and extra features for Phlox theme" plugin (auxin-elements) to a version beyond 2.17.13 that includes a fix for this vulnerability. As a temporary workaround, site administrators can disable the plugin if it is not essential, or use a Web Application Firewall (WAF) rule to block unauthenticated requests to /wp-admin/admin-ajax.php with action=auxels_ajax_search. Wordfence users with active firewall rules may have additional protection while awaiting a plugin update (Wordfence).