CVE-2025-14155

MEDIUMNuclei

Premium Addons for Elementor <= 4.11.53 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'get_template_content'

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-14155 has a selected CVSS score of 5.3 (medium); EIP currently links 1 Nuclei template.

Description

The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_template_content' function in all versions up to, and including, 4.11.53. This makes it possible for unauthenticated attackers to view the content of private, draft, and pending templates.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Feb 23, 2026 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 23, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Premium Addons for Elementor – Powerful Elementor Templates & Widgets

Browse leap13 / Premium Addons for Elementor – Powerful Elementor Templates & Widgets

Default status: unaffected

CVE ListThrough 4.11.53affected

premium_addons_for_elementor

Browse leap13 / premium_addons_for_elementor
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryMEDIUMPremium Addons for Elementor - Unauthenticated Information DisclosureCVSS 5.3

Premium Addons for Elementor plugin for WordPress version 4.11.53 and below contains an unauthenticated information disclosure vulnerability.The vulnerability exists due to a missing authorization check in the get_template_content() AJAX handler, allowing unauthenticated attackers to retrieve private, draft, and pending Elementor templates that may contain sensitive information such as API keys, credentials, customer data,or unpublished content.

Impact

Unauthenticated attackers can view private and unpublished template content, leading to sensitive data disclosure.

Remediation

Update to the latest version beyond 4.11.53.

WeaknessesCWE-862
AuthorsDhiyaneshDk
Template tagscvecve2025wordpresswp-pluginpremium-addons-elementorunauthdisclosurewpvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CPE: cpe:2.3:a:leap13:premium_addons_for_elementor:*:*:*:*:*:wordpress:*:*
https://nvd.nist.gov/vuln/detail/CVE-2025-14155 https://www.wordfence.com/threat-intel/vulnerabilities/id/135c33bb-5ec2-4697-9340-1d2651ff3a0b?source=cve https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/tags/4.11.53/includes/addons-integration.php#L1624 https://plugins.trac.wordpress.org/changeset/3416254/

Source: ProjectDiscovery

References

5