CVE-2025-11997: WordPress Plugin Information Disclosure

CVE-2025-11997 Overview

CVE-2025-11997 affects the Document Pro Elementor – Documentation & Knowledge Base plugin for WordPress in all versions up to and including 1.0.9. The plugin exposes sensitive Algolia API keys through frontend JavaScript code via wp_localize_script without applying access restrictions. Unauthenticated attackers can view these API keys by inspecting the page source of any site running the vulnerable plugin. Attackers can leverage the disclosed credentials to make unauthorized API calls against the configured Algolia search service. The weakness is tracked as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated attackers can extract Algolia API keys from public page source and abuse them to issue unauthorized calls against the site owner's Algolia account.

Affected Products

Document Pro Elementor – Documentation & Knowledge Base plugin for WordPress
All versions up to and including 1.0.9
WordPress sites that configure Algolia search through this plugin

Discovery Timeline

2025-11-11 - CVE-2025-11997 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11997

Vulnerability Analysis

The Document Pro Elementor plugin integrates Algolia to power documentation search. To make the Algolia client work in the browser, the plugin passes configuration values, including the Algolia application ID and API key, from PHP to JavaScript using WordPress core function wp_localize_script. This function serializes the data into an inline <script> tag that is rendered on any page enqueuing the associated script handle. Because the enqueue logic does not restrict output to authenticated administrators or gate the values behind a capability check, the credentials appear in the rendered HTML delivered to every visitor. Any unauthenticated user, including automated scanners, can retrieve the keys by requesting a public documentation page and parsing the response.

Root Cause

The root cause is improper access control on sensitive configuration data output to the client. The vulnerable code paths reside in inc/Base/DPET_Enqueue.php at approximately lines 71 and 85, where the plugin localizes the Algolia credentials into a script variable without conditioning the assignment on user role or context. Secrets intended for server-to-server use are treated as client-side configuration.

Attack Vector

Exploitation requires no authentication, no user interaction, and only network access to the target site. An attacker retrieves any frontend page that loads the plugin's search script, then reads the inlined JavaScript object containing the Algolia application ID and API key. With the extracted key the attacker can issue search, analytics, or write requests against the configured Algolia index depending on the key's scope, potentially exhausting quota, exfiltrating indexed content, or tampering with search records.

See the Wordfence advisory and the affected source in DPET_Enqueue.php for technical details.

Detection Methods for CVE-2025-11997

Indicators of Compromise

Presence of Algolia keys inside inline <script> blocks on pages rendered by the Document Pro Elementor plugin.
Unexpected Algolia API traffic originating from IP addresses outside the site's normal server infrastructure.
Spikes in Algolia dashboard usage metrics, search operations, or rate-limit warnings without corresponding organic traffic.

Detection Strategies

Crawl public pages of WordPress sites running the plugin and grep the response HTML for patterns such as algolia, appId, and apiKey inside localized script variables.
Compare the installed plugin version against 1.0.9 in WordPress inventories and flag any instance at or below that release.
Correlate Algolia API request logs with expected server-side callers and alert on unknown source IPs or user agents.

Monitoring Recommendations

Enable Algolia access logs and forward them to a centralized logging or SIEM platform for anomaly review.
Monitor WordPress plugin update feeds and vulnerability databases for new advisories tied to Document Pro Elementor.
Track outbound API usage counters daily and alert on deviations from established baselines.

How to Mitigate CVE-2025-11997

Immediate Actions Required

Rotate the exposed Algolia API key immediately in the Algolia dashboard and update any legitimate integrations.
Restrict the new key to search-only scope and lock it to specific indices, referrers, or IP ranges where supported.
Update the Document Pro Elementor plugin to a version later than 1.0.9 as soon as the vendor publishes a fix.
Audit Algolia usage logs for the period since the plugin was installed to identify unauthorized queries.

Patch Information

At the time of NVD publication no fixed version is listed. Monitor the WordPress plugin repository and the Wordfence advisory for a patched release beyond 1.0.9 and apply it once available.

Workarounds

Deactivate the Document Pro Elementor plugin until a patched version is released if Algolia search is not business-critical.
Replace the Algolia search integration with a scoped, referrer-restricted search-only API key that cannot perform administrative operations.
Deploy a web application firewall or output filter to strip or redact Algolia key patterns from frontend responses as a temporary control.

bash

# Example: use WP-CLI to identify vulnerable installations
wp plugin list --name=document-pro-elementor --fields=name,status,version

# Deactivate the plugin site-wide until a patch is available
wp plugin deactivate document-pro-elementor