CVE-2025-69300: 
WordPress vulnerability analysis and mitigation

CVE-2025-69300 is a Missing Authorization vulnerability in the Premium Addons for Elementor WordPress plugin developed by Leap13. It allows authenticated attackers with low privileges (Subscriber-level) to exploit incorrectly configured access control security levels, resulting in unauthorized settings changes. The vulnerability affects all versions of the plugin through 4.11.63, and was patched in version 4.11.64. It was reported on December 18, 2025, published by Patchstack on January 17–22, 2026, and carries a CVSS v3.1 base score of 5.4 (Medium) (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before allowing certain settings changes. An authenticated attacker with Subscriber-level access can send crafted requests to modify plugin settings that should be restricted to higher-privileged roles. No complex conditions or user interaction are required beyond having a valid low-privilege account on the target WordPress site (Patchstack).

Successful exploitation allows a low-privileged authenticated attacker to make unauthorized changes to plugin settings, impacting both integrity and availability of the affected WordPress site. There is no direct confidentiality impact (no data exposure), but unauthorized settings modifications could disrupt site functionality or enable further abuse of plugin features. The scope is limited to the affected WordPress instance and does not directly facilitate lateral movement (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority and notes it is unlikely to be exploited, though vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins at scale (Patchstack).

1. Reconnaissance: Identify WordPress sites running Premium Addons for Elementor version 4.11.63 or earlier using tools like WPScan or by checking the plugin's readme.txt file exposed at /wp-content/plugins/premium-addons-for-elementor/readme.txt.
2. Obtain low-privilege access: Register or obtain a Subscriber-level account on the target WordPress site (e.g., via open registration).
3. Identify vulnerable endpoint: Locate the plugin's settings-change AJAX action or REST API endpoint that lacks proper capability checks.
4. Send unauthorized request: As the authenticated Subscriber user, craft and send an HTTP POST request to the vulnerable endpoint with desired settings parameters, bypassing the missing authorization check.
5. Achieve settings modification: The server processes the request without verifying the user's role, applying the attacker-specified settings changes to the plugin configuration (Patchstack).

• Logs: WordPress access logs showing POST requests to plugin-related AJAX endpoints (e.g., wp-admin/admin-ajax.php) from low-privilege user accounts at unusual times or frequencies.
• Logs: WordPress audit logs (if enabled) recording unexpected settings changes attributed to Subscriber-level users.
• File System: Unexpected modifications to plugin configuration or options stored in the WordPress database (wp_options table) related to premium-addons-for-elementor settings.
• Network: Repeated authenticated POST requests from the same IP targeting plugin settings endpoints, potentially indicating automated exploitation attempts.

The vendor (LeapWorx/Leap13) released version 4.11.64 of Premium Addons for Elementor, which patches this vulnerability. Site administrators should update the plugin to version 4.11.64 or later immediately. If an immediate update is not possible, restricting user registration or disabling Subscriber-level account creation can reduce the attack surface. Patchstack users can enable auto-update for vulnerable plugins as an additional mitigation layer (Patchstack).

The vulnerability was discovered and reported by security researcher Phat RiO through Patchstack's Active Vulnerability Disclosure Program (VDP) on December 18, 2025. Patchstack classified it as low priority with low severity impact, noting it is unlikely to be exploited in a targeted manner, though mass-exploit campaigns against WordPress plugins remain a general concern. No significant broader media coverage or notable social media discussion has been identified for this specific CVE (Patchstack).