CVE-2025-12778 Overview
CVE-2025-12778 affects the Ultimate Member Widgets for Elementor – WordPress User Directory plugin for WordPress. The vulnerability stems from a missing capability check on the handle_filter_users function. All versions up to and including 2.3 are affected.
Unauthenticated attackers can extract partial metadata of every WordPress user on the site. Exposed fields include first name, last name, and email address. The flaw is classified as a Missing Authorization issue [CWE-862].
Critical Impact
Unauthenticated attackers can enumerate all WordPress user accounts and harvest personally identifiable information for targeted phishing and credential-stuffing campaigns.
Affected Products
- Ultimate Member Widgets for Elementor – WordPress User Directory plugin
- All plugin versions up to and including 2.3
- WordPress installations using the vulnerable plugin
Discovery Timeline
- 2025-11-20 - CVE-2025-12778 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-12778
Vulnerability Analysis
The vulnerability resides in the handle_filter_users function of the Ultimate Member Widgets for Elementor plugin. The function processes user filtering requests but omits a capability check to verify that the caller is authorized to query user data. As a result, the endpoint responds to unauthenticated HTTP requests.
When invoked, the function returns partial user metadata drawn from the WordPress users table. Attackers can iterate through the exposed endpoint to enumerate every registered account. The disclosed fields include first name, last name, and email address, which are commonly considered non-public data.
The flaw is a broken access control issue mapped to [CWE-862] Missing Authorization. It requires no authentication, no user interaction, and can be triggered remotely over the network.
Root Cause
The root cause is the absence of a WordPress capability check inside handle_filter_users. WordPress AJAX handlers registered via wp_ajax_nopriv_ action hooks must perform explicit permission validation using current_user_can() or equivalent. The vulnerable handler executes its query logic without this gate, exposing user records to any unauthenticated client.
Attack Vector
An attacker sends crafted HTTP requests directly to the plugin's AJAX endpoint. The plugin returns a JSON payload containing user metadata. By repeating requests with different filter parameters, an attacker enumerates the full user directory and captures email addresses for downstream attacks such as phishing, password spraying, or credential stuffing.
The vulnerability manifests through unauthenticated AJAX invocation of handle_filter_users. See the referenced Wordfence Vulnerability Report and the WordPress Plugin Change Log for the code path and applied fix.
Detection Methods for CVE-2025-12778
Indicators of Compromise
- Repeated POST requests to admin-ajax.php with the action parameter targeting the plugin's filter users handler.
- High-volume responses containing serialized user metadata fields such as first_name, last_name, and user_email.
- Unauthenticated source IP addresses generating enumeration-style traffic patterns against WordPress sites running the plugin.
Detection Strategies
- Inspect web server access logs for unauthenticated requests to wp-admin/admin-ajax.php invoking the vulnerable action.
- Deploy a Web Application Firewall (WAF) rule to flag anomalous request rates against the plugin endpoint.
- Correlate spikes in outbound email or phishing complaints with prior access log activity targeting the endpoint.
Monitoring Recommendations
- Enable audit logging for all AJAX actions exposed by installed WordPress plugins.
- Monitor for enumeration signatures such as sequential filter parameter variations from a single client.
- Alert on any HTTP 200 responses that return user email arrays to unauthenticated requestors.
How to Mitigate CVE-2025-12778
Immediate Actions Required
- Update the Ultimate Member Widgets for Elementor plugin to a version later than 2.3.
- If an updated version is unavailable, deactivate and remove the plugin until a fix is applied.
- Notify users whose email addresses may have been exposed and monitor for targeted phishing activity.
Patch Information
The vendor addressed the missing capability check in the changeset published at WordPress Plugin Change Log. Site administrators should apply the fixed release through the WordPress plugin updater. Confirm the installed version is greater than 2.3 after upgrade.
Workarounds
- Block unauthenticated access to admin-ajax.php actions exposed by the plugin using a WAF rule.
- Restrict access to the WordPress site by IP allowlist while the patch is pending.
- Temporarily disable the plugin at the file system level by renaming its directory under wp-content/plugins/.
# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate ultimate-member-widgets-for-elementor
wp plugin update ultimate-member-widgets-for-elementor
wp plugin list --name=ultimate-member-widgets-for-elementor --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
