CVE-2025-68494: 
WordPress vulnerability analysis and mitigation

CVE-2025-68494 is a Sensitive Data Exposure vulnerability in the Premium Addons for Elementor WordPress plugin developed by Leap13 (LeapWorx). It allows unauthenticated remote attackers to retrieve embedded sensitive system information that should not be accessible to unauthorized parties. The vulnerability affects all plugin versions up to and including 4.11.53, with version 4.11.54 containing the fix. It was reported by researcher 'Mdr' on November 4, 2025, and published by Patchstack on December 4, 2025, with CVE assignment on December 24, 2025. The CVSS v3.1 base score is 5.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), mapped to CAPEC-170 (Web Application Fingerprinting). It is exploitable over the network with low attack complexity, requires no authentication or user interaction, and has an unchanged scope. The flaw allows attackers to retrieve embedded sensitive data from the plugin, which could be leveraged to facilitate further attacks against the WordPress installation. No detailed technical write-up or proof-of-concept code has been publicly disclosed beyond the Patchstack advisory (Patchstack).

Successful exploitation allows an unauthenticated attacker to access sensitive system information that is normally restricted, such as configuration details or internal data embedded within the plugin. While the direct impact is limited to confidentiality (no integrity or availability impact), the exposed information could be used to fingerprint the target environment and enable more targeted follow-on attacks. Patchstack classifies this as low priority with no impactful threat in isolation, but notes that such vulnerabilities are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or traffic (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-68494. The EPSS score is approximately 0.031% (0.000310), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack rates the exploitation likelihood as low, though it notes that similar information disclosure flaws are sometimes incorporated into mass-scanning campaigns targeting WordPress plugins (Patchstack).

The vendor (LeapWorx) has released version 4.11.54 of Premium Addons for Elementor, which patches this vulnerability. Site administrators should update the plugin to version 4.11.54 or later immediately via the WordPress admin dashboard. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, site owners should consult their hosting provider or web developer for assistance (Patchstack).

The vulnerability was discovered and disclosed through Patchstack's Active VDP (Vulnerability Disclosure Program), with researcher 'Mdr' credited for the report. Patchstack characterizes the issue as low priority with unlikely exploitation impact. No notable independent researcher commentary, vendor statements beyond the patch release, or significant media coverage has been identified for this CVE.