CVE-2025-68494

Executive Summary

CVE-2025-68494 is an information disclosure vulnerability in the Leap13 Premium Addons for Elementor WordPress plugin, affecting versions up to and including 4.11.53. The flaw allows an unauthenticated attacker to retrieve embedded sensitive data from the plugin's configuration or stored data, leading to exposure of system information. This is classified as an Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-200) with a CVSS score of 5.3 (Medium). No public proof-of-concept or patch is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. However, given the widespread use of Elementor and its add-ons, this vulnerability poses a risk to WordPress sites using the affected plugin.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Since it is a PHP-based plugin, the supply chain risk involves compromised plugin updates or malicious forks. Administrators should verify plugin integrity via checksums and monitor for official patches from Leap13.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The threat level is Medium due to the low complexity and no authentication requirement, but the impact is limited to information disclosure without direct system compromise.

Deep Dive & Mechanics

The vulnerability resides in the Premium Addons for Elementor plugin, which extends the Elementor page builder with additional widgets and features. The flaw involves improper access control or sanitization when handling requests that expose sensitive system information, such as database credentials, API keys, or internal file paths. The exact mechanism is not publicly documented, but based on the CWE-200 classification, it likely involves:

• An unauthenticated endpoint that returns plugin configuration data.
• A widget or AJAX handler that leaks embedded data (e.g., from shortcodes or custom fields).
• Insufficient authorization checks on REST API routes or admin-ajax actions.

The vulnerability affects all versions from n/a through 4.11.53, suggesting a long-standing issue in the codebase.

Vulnerable vs. Patched Code

Since no patch is available, a hypothetical vulnerable code snippet might look like:

// Vulnerable: No permission check
add_action('wp_ajax_nopriv_get_premium_data', 'premium_get_data');
function premium_get_data() {
    $data = get_option('premium_addons_settings');
    wp_send_json($data);
}

A patched version would include:

// Patched: Check user capabilities
add_action('wp_ajax_get_premium_data', 'premium_get_data');
function premium_get_data() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    $data = get_option('premium_addons_settings');
    wp_send_json($data);
}

Exploitation & Lab Setup

Red Team

To exploit this vulnerability in a lab environment:

1. Setup: Install WordPress with the Premium Addons for Elementor plugin version 4.11.53.
2. Recon: Identify exposed endpoints using tools like wpscan or manual inspection of plugin AJAX actions.
3. Exploit: Send a crafted HTTP request to the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=get_premium_data).
4. Extract: Parse the JSON response to retrieve sensitive data.

Example curl command:

curl -X POST http://target/wp-admin/admin-ajax.php \
  -d "action=get_premium_data"

Blue Team

To detect exploitation:

• Monitor for unusual AJAX requests to admin-ajax.php with unknown actions.
• Look for responses containing configuration data or system paths.
• Use WAF rules to block requests to unauthenticated plugin endpoints.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /wp-admin/admin-ajax.php with action parameters like get_premium_data or similar.
• File: Presence of plugin files in /wp-content/plugins/premium-addons-for-elementor/ version <= 4.11.53.
• Log: WordPress debug logs showing unexpected data exposure.
• Response: JSON responses containing wp-config.php paths, database credentials, or API keys.

Detection Engineering

YARA Rule

rule Detect_Premium_Addons_Info_Disclosure {
    meta:
        description = "Detects CVE-2025-68494 exploitation attempts"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-68494"
    strings:
        $ajax_action = "action=get_premium_data"
        $plugin_path = "premium-addons-for-elementor"
        $sensitive_data = /(DB_NAME|DB_USER|DB_PASSWORD|API_KEY)/
    condition:
        $ajax_action or ($plugin_path and $sensitive_data)
}

Sigma Rule

title: CVE-2025-68494 - Premium Addons for Elementor Info Disclosure
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects exploitation attempts of CVE-2025-68494
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=get_premium_data'
    condition: selection
falsepositives:
    - Legitimate plugin updates
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-68494 - Premium Addons for Elementor Info Disclosure"; flow:to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=get_premium_data"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable the Premium Addons for Elementor plugin until a patch is released.
• Workaround: Implement a Web Application Firewall (WAF) rule to block requests to unknown AJAX actions.
• Long-term: Monitor the Leap13 vendor page for updates and apply the patch as soon as it becomes available.
• Hardening: Restrict access to admin-ajax.php using .htaccess or server-level rules for unauthenticated users.

Valters IT
Securing Digital Frontiers