CVE-2025-13215: Phlox Plugin Information Disclosure Flaw

CVE-2025-13215 Overview

CVE-2025-13215 is an Information Exposure vulnerability affecting the Shortcodes and extra features for Phlox theme plugin for WordPress. The vulnerability exists in all versions up to and including 2.17.13 and stems from insufficient restrictions on which posts can be included in search results via the auxels_ajax_search function. This flaw allows unauthenticated attackers to extract titles of draft posts that should remain private and inaccessible.

Critical Impact
Unauthenticated attackers can extract sensitive information from draft posts, potentially exposing unpublished content, confidential business information, or planned announcements before they are ready for public release.

Affected Products

Shortcodes and extra features for Phlox theme plugin for WordPress versions up to and including 2.17.13
WordPress sites using the Phlox theme with the auxin-elements plugin
Any WordPress installation with the vulnerable auxels_ajax_search AJAX endpoint exposed

Discovery Timeline

2026-01-06 - CVE CVE-2025-13215 published to NVD
2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-13215

Vulnerability Analysis

This vulnerability is classified as Information Exposure (CWE-200), which occurs when an application unintentionally reveals sensitive information to an actor not explicitly authorized to access it. In this case, the auxels_ajax_search function in the Phlox theme's shortcodes plugin fails to properly filter search results based on post status, allowing draft posts to be included in AJAX search responses.

The vulnerability is particularly concerning because it requires no authentication to exploit. Any unauthenticated user can craft requests to the vulnerable AJAX endpoint and enumerate draft post titles, potentially revealing sensitive unpublished content. While the vulnerability only exposes post titles rather than full content, this can still lead to significant information disclosure, especially for organizations that use draft posts to prepare announcements, product releases, or confidential communications.

Root Cause

The root cause of this vulnerability lies in the auxels_ajax_search function located in the frontend-ajax.php file. The function fails to implement proper post status checks when querying posts for search results. Without adequate filtering, the WordPress query includes posts with a 'draft' status alongside published posts, exposing titles that should remain hidden from public access.

The vulnerable code can be reviewed in the WordPress Plugin Code Review at line 348 of the frontend-ajax.php file, where the AJAX search handler processes requests without restricting results to only published content.

Attack Vector

The attack is network-based and can be executed remotely without any authentication or user interaction. An attacker can exploit this vulnerability by sending crafted AJAX requests to the auxels_ajax_search endpoint on any WordPress site running the vulnerable plugin version.

The attack flow involves:

Identifying a WordPress site using the Phlox theme with the auxin-elements plugin
Sending AJAX requests to the auxels_ajax_search endpoint with various search terms
Analyzing responses to identify and extract draft post titles
Correlating extracted information to build intelligence about unpublished content

Since no authentication is required and the attack complexity is low, this vulnerability presents a straightforward exploitation path for attackers seeking to gather intelligence on unpublished content.

Detection Methods for CVE-2025-13215

Indicators of Compromise

Unusual volume of AJAX requests to /wp-admin/admin-ajax.php with action=auxels_ajax_search parameter
Search query patterns attempting to enumerate content through systematic keyword testing
Access logs showing repeated requests from single IP addresses to the AJAX search endpoint
Requests with uncommon or sequential search terms indicating automated enumeration

Detection Strategies

Monitor web server access logs for abnormal patterns of requests to the admin-ajax.php endpoint with the auxels_ajax_search action
Implement rate limiting on AJAX endpoints to detect and block automated enumeration attempts
Deploy web application firewall (WAF) rules to flag suspicious search patterns targeting the vulnerable endpoint
Use WordPress security plugins to audit and log AJAX handler access

Monitoring Recommendations

Enable detailed logging for WordPress AJAX requests, particularly those involving search functionality
Set up alerts for high-frequency requests to the auxels_ajax_search endpoint from single IP addresses
Regularly audit plugin versions and maintain an inventory of installed WordPress plugins across all sites
Implement network-level monitoring to detect reconnaissance activity targeting WordPress installations

How to Mitigate CVE-2025-13215

Immediate Actions Required

Update the Shortcodes and extra features for Phlox theme plugin to a version newer than 2.17.13 immediately
Review web server logs for evidence of prior exploitation attempts targeting the auxels_ajax_search endpoint
Audit draft posts on affected sites to assess potential information exposure
Consider temporarily disabling the AJAX search functionality if an update is not immediately available

Patch Information

Users should update the Shortcodes and extra features for Phlox theme plugin to the latest available version that addresses this vulnerability. The patch implements proper post status filtering in the auxels_ajax_search function to ensure only published posts are included in search results.

For detailed vulnerability information and patch verification, refer to the Wordfence Vulnerability Report.

Workarounds

Disable the AJAX search feature by deactivating the plugin until an update can be applied
Implement a web application firewall rule to block or monitor requests to the auxels_ajax_search action
Restrict access to admin-ajax.php for unauthenticated users if the search functionality is not critical
Move sensitive content from draft posts to a separate, more secure content management workflow

bash

# WordPress plugin update via WP-CLI
wp plugin update auxin-elements

# Verify current plugin version
wp plugin list --name=auxin-elements --fields=name,status,version

# Temporarily deactivate plugin if update is not available
wp plugin deactivate auxin-elements