CVE-2025-6253

HIGH

UiCore Elements <= 1.3.0 - Unauthenticated Arbitrary File Read

Title source: llm
STIX 2.1

Description

The UiCore Elements – Free Elementor widgets and templates plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.3.0 via the prepare_template() function due to a missing capability check and insufficient controls on the filename specified. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

References (2)

Core 2

Scores

CVSS v3 7.5
EPSS 0.0037
EPSS Percentile 28.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (2)
uicore/UiCore Elements – Free Elementor widgets and templates < 1.3.0
uicore/UiCore Elements – Free widgets and templates for Elementor < 1.3.0
Published Aug 12, 2025
Tracked Since Feb 18, 2026