CVE-2025-0968

Executive Summary

CVE-2025-0968 is a Sensitive Information Exposure vulnerability in the ElementsKit Elementor addons plugin for WordPress, affecting all versions up to and including 3.4.0. The flaw resides in the get_megamenu_content() function, which lacks proper capability checks, allowing unauthenticated attackers to view any Elementor-created content, including drafts, trashed items, and private posts/pages/templates. This vulnerability is classified as a WordPress ecosystem issue and does not involve Apache or Nginx directly.

The CVSS score is 5.3 (Medium), with a low EPSS score of 0.0%, indicating low exploitation likelihood at this time. However, the lack of a patch and the simplicity of exploitation (no authentication required) make this a significant concern for WordPress site administrators.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin’s update channel for a patched version. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (exposure of sensitive content)
• Integrity Impact: None
• Availability Impact: None

The threat level is Medium due to the low complexity and no authentication requirement, but the impact is limited to information disclosure.

Deep Dive & Mechanics

The vulnerability exists in the get_megamenu_content() function within the ElementsKit plugin. This function is intended to retrieve content for mega menu items, but it fails to perform proper capability checks (e.g., current_user_can() or wp_verify_nonce()). As a result, any unauthenticated user can call this function via a WordPress AJAX action or REST endpoint, and it will return the content of any Elementor-built item, including:

• Published posts/pages
• Drafts
• Trashed items
• Private items

The function likely uses get_post() or get_page_by_path() without verifying the post status or user permissions. An attacker can enumerate post IDs or slugs to extract sensitive information.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.4.0):

public function get_megamenu_content() {
    $post_id = $_POST['post_id']; // No sanitization or capability check
    $content = Elementor\Plugin::instance()->frontend->get_builder_content_for_display($post_id);
    wp_send_json_success($content);
}

Patched Code (Hypothetical):

public function get_megamenu_content() {
    if (!current_user_can('edit_posts')) {
        wp_send_json_error('Unauthorized');
    }
    $post_id = intval($_POST['post_id']);
    $post = get_post($post_id);
    if (!$post || $post->post_status !== 'publish') {
        wp_send_json_error('Invalid post');
    }
    $content = Elementor\Plugin::instance()->frontend->get_builder_content_for_display($post_id);
    wp_send_json_success($content);
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Target WordPress site with ElementsKit plugin <= 3.4.0
• No authentication required

Exploit Steps:

1. Identify the AJAX action endpoint (e.g., /wp-admin/admin-ajax.php?action=get_megamenu_content).
2. Send a POST request with a target post ID (e.g., post_id=123).
3. Receive the Elementor content in the response.

Proof-of-Concept (Python):

import requests

target_url = "https://target-site.com/wp-admin/admin-ajax.php"
data = {
    "action": "get_megamenu_content",
    "post_id": 123  # Replace with target post ID
}
response = requests.post(target_url, data=data)
print(response.text)

Exploit-DB Code: None available.

Blue Team (Defender)

Detection Steps:

• Monitor for unusual AJAX requests to admin-ajax.php with action=get_megamenu_content.
• Check for repeated requests with varying post_id values.
• Review server logs for unauthorized access to Elementor content.

Honeypot Setup:

• Create a fake private post with a honeypot token.
• Monitor for access to that post via the vulnerable endpoint.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=get_megamenu_content
  • Unusual post_id values (e.g., high IDs, negative IDs)
• File:
  • Log entries showing get_megamenu_content action from unauthenticated IPs
• Behavioral:
  • Rapid enumeration of post IDs via the vulnerable endpoint

Detection Engineering

YARA Rule

rule Detect_ElementsKit_Exposure {
    meta:
        description = "Detects exploitation attempts for CVE-2025-0968"
        author = "Valters IT"
        date = "2025-03-01"
    strings:
        $ajax_action = "get_megamenu_content"
        $post_id = "post_id"
    condition:
        $ajax_action and $post_id
}

Sigma Rule

title: CVE-2025-0968 ElementsKit Information Disclosure
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects unauthenticated access to ElementsKit megamenu content
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: 'action=get_megamenu_content'
    condition: selection
falsepositives:
    - Legitimate admin usage (rare)
level: medium

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-0968 ElementsKit Information Disclosure Attempt";
    flow:to_server;
    content:"POST";
    http_method;
    content:"admin-ajax.php";
    http_uri;
    content:"action=get_megamenu_content";
    http_client_body;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Restrict access to admin-ajax.php via .htaccess or firewall rules for unauthenticated users.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Apply a patch from the vendor (when available) that adds capability checks to get_megamenu_content().
• Update to a patched version (currently none available).

Workaround:

• Use a Web Application Firewall (WAF) to block requests containing action=get_megamenu_content from unauthenticated sources.

Valters IT
Securing Digital Frontiers