CVE-2025-66116: 
WordPress vulnerability analysis and mitigation

CVE-2025-66116 is a Sensitive Data Exposure vulnerability in the Ultimate Member Widgets for Elementor WordPress plugin, developed by UserElements. The flaw allows unauthenticated remote attackers to retrieve embedded sensitive data from affected WordPress sites. All plugin versions up to and including 2.3 are affected. It was published on December 18, 2025, and assigned by Patchstack. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Feedly, Patchstack).

The vulnerability is classified as CWE-201: Insertion of Sensitive Information Into Sent Data, meaning the plugin inadvertently includes sensitive information in data transmitted to clients or external parties. No authentication or user interaction is required for exploitation (attack vector: Network, attack complexity: Low, privileges required: None), making it trivially accessible to any remote attacker. The specific mechanism involves the plugin embedding sensitive data — likely user profile fields or membership-related information managed by the Ultimate Member ecosystem — within Elementor widget output that is returned to unauthenticated requesters. No public proof-of-concept code has been identified at this time (Feedly, Patchstack).

Successful exploitation results in a high confidentiality impact with no effect on integrity or availability. An unauthenticated attacker can retrieve sensitive user data embedded in Elementor widget responses — potentially including personal information, email addresses, or other membership-related data stored by the Ultimate Member plugin. This data exposure could facilitate further attacks such as targeted phishing, credential stuffing, or account enumeration against site members (Feedly).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-66116 as of the available data. The EPSS score is approximately 0.018%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

Users should update the Ultimate Member Widgets for Elementor plugin to a version beyond 2.3 as soon as a patched release becomes available from the plugin author (UserElements). In the interim, site administrators should consider deactivating the plugin if sensitive member data exposure is a concern, or restricting access to pages containing the affected Elementor widgets. Monitoring the WordPress plugin repository and the Patchstack advisory for patch availability is recommended (Patchstack).