CVE-2025-14155: 
WordPress vulnerability analysis and mitigation

CVE-2025-14155 is a Missing Authorization vulnerability in the Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress. Due to a missing capability check on the get_template_content function, unauthenticated attackers can access the content of private, draft, and pending templates. All plugin versions up to and including 4.11.53 are affected; version 4.11.54 introduces the fix. It carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, Red Hat CVE). The vulnerability was published on December 23, 2025, and assigned by Wordfence.

The root cause is classified as CWE-862 (Missing Authorization). The vulnerable get_template_content function, located in includes/addons-integration.php (around line 1624), is registered as an AJAX handler without any WordPress capability or nonce check, making it accessible to unauthenticated users over the network (Wordfence, WordPress Trac). An attacker simply needs to send a crafted HTTP request to the WordPress AJAX endpoint (wp-admin/admin-ajax.php) invoking this action — no authentication, elevated privileges, or user interaction is required. A Nuclei detection template has been developed and merged into the ProjectDiscovery nuclei-templates repository, facilitating automated scanning (Nuclei Templates).

Successful exploitation results in unauthorized disclosure of sensitive template content — including private, draft, and pending Elementor templates — that site owners intended to keep confidential. This is a confidentiality-only impact (no integrity or availability impact), but exposed templates may contain sensitive business information, unreleased content, or design details that could aid further attacks. The scope is limited to the affected WordPress installation; however, on sites where templates contain sensitive data, the information disclosure could facilitate targeted social engineering or competitive intelligence gathering (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.029%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, a Nuclei template for automated detection has been added to the ProjectDiscovery nuclei-templates repository (merged in multiple commits), which lowers the barrier for opportunistic scanning (Nuclei Templates, Wordfence). No threat actor attribution has been identified.

1. Reconnaissance: Identify WordPress sites running the Premium Addons for Elementor plugin at version ≤ 4.11.53 using tools like WPScan, Shodan, or automated Nuclei scans with the available detection template.
2. Identify the vulnerable AJAX action: The get_template_content function is registered as a WordPress AJAX action (both for logged-in and non-logged-in users) in includes/addons-integration.php.
3. Craft the HTTP request: Send an unauthenticated POST request to https://target-site.com/wp-admin/admin-ajax.php with the appropriate action parameter corresponding to the get_template_content handler and a target template ID.
4. Retrieve template content: The server responds with the full content of the requested private, draft, or pending Elementor template, bypassing any access controls (Wordfence, WordPress Trac).

• Network: Unusual or repeated unauthenticated POST requests to /wp-admin/admin-ajax.php with an action parameter matching the get_template_content handler from external or unknown IP addresses.
• Logs: WordPress access logs showing high-frequency requests to admin-ajax.php without a valid session cookie or nonce, particularly targeting template-related actions.
• Logs: HTTP 200 responses to admin-ajax.php requests from unauthenticated sources returning template JSON data.

Update the Premium Addons for Elementor plugin to version 4.11.54 or later, which introduces the required capability check on the get_template_content function (WordPress Trac Changeset). No official configuration-based workaround has been published; upgrading is the only recommended remediation. Site administrators should also audit their Elementor templates for sensitive content and review access logs for signs of unauthorized access prior to patching.

The vulnerability was reported and assigned by Wordfence, which published the advisory on December 23, 2025. Community interest has been moderate, with automated aggregation across vulnerability databases (VulDB, Vulners, CIRCL, ENISA EUVD) and some social media discussion on Bluesky. The ProjectDiscovery community contributed Nuclei detection templates, reflecting standard community response for WordPress plugin vulnerabilities of this severity (Nuclei Templates, Wordfence).