CVE-2025-0968: ElementsKit Information Disclosure Flaw

CVE-2025-0968 Overview

The ElementsKit Elementor addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.0 due to missing capability checks on the get_megamenu_content() function. This authorization bypass vulnerability makes it possible for unauthenticated attackers to view any item created in Elementor, including posts, pages, and templates—even those in draft, trashed, or private status.

Critical Impact

Unauthenticated attackers can access sensitive content including drafts, private posts, and trashed items created with Elementor, potentially exposing confidential business information and unpublished content.

Affected Products

• wpmet ElementsKit Elementor Addons versions up to and including 3.4.0
• WordPress sites using the ElementsKit Lite plugin
• All Elementor-created content (posts, pages, templates) on affected installations

Discovery Timeline

• February 19, 2025 - CVE-2025-0968 published to NVD
• February 25, 2025 - Last updated in NVD database

Technical Details for CVE-2025-0968

Vulnerability Analysis

This vulnerability is classified under CWE-862 (Missing Authorization) and CWE-284 (Improper Access Control). The core issue lies in the get_megamenu_content() function within the ElementsKit plugin's megamenu API module, which fails to implement proper capability checks before returning content.

When the vulnerable function is invoked, it retrieves and displays Elementor-rendered content without verifying whether the requesting user has appropriate permissions to view that content. This architectural flaw allows any unauthenticated remote attacker to request and receive content that should be restricted, including draft posts, private pages, and trashed content.

The network-based attack vector requires no user interaction and can be executed with low complexity, making it particularly concerning for WordPress sites that store sensitive information in draft or private content.

Root Cause

The root cause is the absence of WordPress capability checks within the get_megamenu_content() function located in the megamenu API module (modules/megamenu/api.php). WordPress provides built-in functions like current_user_can() and permission constants that developers should use to verify user capabilities before serving restricted content. The vulnerable code path directly returns content without any authorization validation, bypassing WordPress's native access control mechanisms.

Attack Vector

The vulnerability is exploited through network-accessible requests to the vulnerable API endpoint. An attacker can craft HTTP requests to the get_megamenu_content() function, specifying arbitrary post IDs or content identifiers. Without proper capability checks, the function returns the requested Elementor content regardless of the requester's authentication status.

The attack flow involves:

1. Identifying a WordPress site using the ElementsKit Elementor addons plugin
2. Crafting requests to the vulnerable megamenu API endpoint
3. Iterating through content IDs to enumerate and retrieve sensitive posts, pages, and templates
4. Accessing draft, private, or trashed content that should be restricted

For technical details on the vulnerable code path, see the WordPress Plugin Code Reference.

Detection Methods for CVE-2025-0968

Indicators of Compromise

• Unusual volume of requests to ElementsKit megamenu API endpoints from unauthenticated sources
• Access logs showing sequential or enumerated content ID requests
• HTTP requests targeting /wp-json/ or AJAX endpoints associated with ElementsKit megamenu functionality
• Server logs indicating access to draft or private content by anonymous users

Detection Strategies

• Monitor web server access logs for suspicious patterns of requests to ElementsKit API endpoints
• Implement Web Application Firewall (WAF) rules to detect and block unauthorized content enumeration attempts
• Review WordPress audit logs for unusual content access patterns, particularly to non-published content
• Deploy SentinelOne Singularity Platform to detect anomalous WordPress plugin behavior and unauthorized data access

Monitoring Recommendations

• Enable verbose logging for WordPress REST API and AJAX requests
• Configure alerts for high-frequency requests to megamenu-related endpoints from single IP addresses
• Monitor for access attempts to content with post_status values of draft, private, pending, or trash
• Implement rate limiting on API endpoints to prevent automated content enumeration

How to Mitigate CVE-2025-0968

Immediate Actions Required

• Update ElementsKit Elementor addons plugin to the latest patched version immediately
• Review server access logs to identify potential exploitation attempts
• Audit sensitive content that may have been exposed through the vulnerability
• Consider temporarily disabling the megamenu functionality if immediate patching is not possible

Patch Information

The vendor has released a security patch addressing this vulnerability. The fix is available in the WordPress Change Set Log which adds proper capability checks to the get_megamenu_content() function before returning content.

Users should update to the latest version of ElementsKit Elementor addons through the WordPress plugin manager or by downloading the updated version from the WordPress Plugin Directory.

For detailed vulnerability information, refer to the Wordfence Vulnerability Report.

Workarounds

• Restrict access to WordPress REST API endpoints using server-level firewall rules or .htaccess configurations
• Implement IP-based access controls to limit API access to trusted sources only
• Disable the ElementsKit megamenu module if not actively used until patching is possible
• Deploy a Web Application Firewall with rules to block unauthorized content requests

# Example .htaccess rule to restrict API access (temporary workaround)
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-json/elementskit/ [NC]
RewriteCond %{REQUEST_METHOD} ^(GET|POST)$
RewriteCond %{REMOTE_ADDR} !^(trusted\.ip\.address)$
RewriteRule ^(.*)$ - [F,L]
</IfModule>