CVE-2025-13997: King Addons for Elementor API Disclosure

CVE-2025-13997 Overview

CVE-2025-13997 is an information disclosure vulnerability affecting the King Addons for Elementor WordPress plugin. The vulnerability exists in all versions up to and including 51.1.49, where the plugin improperly exposes sensitive API keys by embedding them directly into the HTML source code through the render_full_form function. This security flaw allows unauthenticated attackers to extract Mailchimp, Facebook, and Google API keys and secrets from affected WordPress sites.

Critical Impact

Unauthenticated attackers can extract sensitive third-party API credentials (Mailchimp, Facebook, Google) from the HTML source code, potentially leading to unauthorized access to connected services and data exfiltration.

Affected Products

• King Addons for Elementor plugin for WordPress versions up to and including 51.1.49
• WordPress sites with the King Addons Premium license installed
• Sites utilizing the Login/Register Form widget with third-party API integrations

Discovery Timeline

• 2026-03-23 - CVE CVE-2025-13997 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2025-13997

Vulnerability Analysis

This vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The core issue stems from insecure handling of API credentials within the plugin's form rendering mechanism. When the render_full_form function processes forms that integrate with third-party services like Mailchimp, Facebook, or Google, it embeds the associated API keys and secrets directly into the HTML output sent to the browser.

This architectural flaw means that any visitor to a page containing an affected form can simply view the page source to extract these sensitive credentials. The vulnerability specifically affects sites running the Premium license version of the plugin, as these API integrations are premium features.

Root Cause

The root cause of this vulnerability lies in the render_full_form function located in Login_Register_Form.php. Instead of handling API credentials server-side or using secure token-based authentication, the plugin directly outputs API keys and secrets into the client-side HTML markup. This design decision violates fundamental security principles regarding the handling of sensitive credentials, which should never be exposed to untrusted client environments.

Attack Vector

The attack vector for CVE-2025-13997 is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability through the following method:

1. Navigate to any WordPress page containing a King Addons form widget that uses third-party API integrations
2. View the HTML source code of the page using browser developer tools or by right-clicking and selecting "View Page Source"
3. Search the HTML for API key patterns or inspect the form-related markup
4. Extract the exposed Mailchimp, Facebook, or Google API keys and secrets

The vulnerability is documented in the WordPress Plugin Source Code where the sensitive credential handling occurs within the form rendering logic. No proof-of-concept code is required as exploitation is trivial—simply viewing the page source exposes the credentials.

Detection Methods for CVE-2025-13997

Indicators of Compromise

• Unusual API usage patterns on connected Mailchimp, Facebook, or Google accounts
• Unauthorized email campaigns sent through exposed Mailchimp API credentials
• Suspicious authentication attempts or data access on linked third-party services
• Unexpected changes to Facebook page settings or Google service configurations

Detection Strategies

• Review HTML source code of pages containing King Addons forms for exposed API keys
• Monitor third-party API usage logs for anomalous access patterns or unauthorized IP addresses
• Implement web application firewalls (WAF) rules to detect scanning for common API key patterns in responses
• Conduct regular security audits of WordPress plugin configurations and outputs

Monitoring Recommendations

• Enable detailed logging on all third-party services (Mailchimp, Facebook, Google) connected to your WordPress site
• Set up alerts for API key usage from unfamiliar IP addresses or geographic locations
• Monitor WordPress access logs for unusual page view patterns that may indicate reconnaissance activity
• Review third-party service audit logs for unauthorized configuration changes

How to Mitigate CVE-2025-13997

Immediate Actions Required

• Update King Addons for Elementor plugin to a version newer than 51.1.49 when a patch becomes available
• Immediately rotate all API keys (Mailchimp, Facebook, Google) configured in the plugin
• Temporarily disable forms using third-party API integrations until the vulnerability is patched
• Review third-party service logs for signs of unauthorized access using potentially compromised credentials

Patch Information

Site administrators should monitor the official WordPress plugin repository and the Wordfence Vulnerability Report for updates regarding a security patch. Once a patched version is released, update immediately and ensure all API credentials are regenerated, as previous keys may have been compromised.

Workarounds

• Disable the Login/Register Form widget or any forms utilizing Mailchimp, Facebook, or Google integrations until patched
• Remove API keys from the plugin configuration temporarily and use alternative form submission methods
• Implement IP-based restrictions on third-party API keys to limit potential abuse if credentials were exposed
• Consider using a security plugin to monitor and restrict access to sensitive form pages

# Rotate API keys after mitigation
# 1. Access your WordPress admin panel
# 2. Navigate to King Addons settings
# 3. Remove existing API keys from all integrations
# 4. Generate new API keys from respective services:
#    - Mailchimp: Account > Extras > API keys
#    - Facebook: Developer Portal > App Settings
#    - Google: Cloud Console > APIs & Services > Credentials
# 5. Apply IP restrictions where supported by the service