CVE-2025-14163 Overview
CVE-2025-14163 is a Cross-Site Request Forgery (CSRF) vulnerability in the Premium Addons for Elementor plugin for WordPress. The flaw affects all versions up to and including 4.11.53. The plugin's insert_inner_template function fails to validate WordPress nonces before creating Elementor templates. Unauthenticated attackers can forge requests that create arbitrary Elementor templates when a site administrator, or any user holding the edit_posts capability, is tricked into clicking a malicious link. The vulnerability maps to [CWE-352] Cross-Site Request Forgery. The vendor leap13 addressed the issue in a subsequent plugin release published through the WordPress plugin repository.
Critical Impact
Attackers can create arbitrary Elementor templates on affected WordPress sites by tricking authenticated users into clicking crafted links.
Affected Products
- Leap13 Premium Addons for Elementor (WordPress plugin)
- All versions up to and including 4.11.53
- WordPress sites running the vulnerable plugin with users holding the edit_posts capability
Discovery Timeline
- 2025-12-23 - CVE-2025-14163 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-14163
Vulnerability Analysis
The vulnerability originates in the plugin's template management code path. Specifically, the insert_inner_template function in includes/templates/classes/manager.php handles requests to create inner Elementor templates but does not verify a WordPress nonce token before processing the request. WordPress relies on nonces to bind sensitive state-changing actions to an authenticated user session, and the absence of check_ajax_referer or wp_verify_nonce breaks that binding. Because the vulnerable handler still enforces capability checks on the target user's session cookie, an attacker cannot invoke it directly without authentication. Instead, the attacker forges a request that the browser of a logged-in privileged user submits automatically, satisfying the capability check while bypassing intent verification.
Root Cause
The root cause is missing nonce validation on a state-changing AJAX endpoint. The insert_inner_template function accepts template creation parameters from the request without confirming the request originated from a trusted plugin UI action. This design flaw falls under [CWE-352] and violates the WordPress security guideline requiring nonce checks on all privileged AJAX handlers.
Attack Vector
Exploitation requires user interaction from an authenticated WordPress user with the edit_posts capability, which includes administrators, editors, authors, and contributors. The attacker hosts a malicious page or crafts a link that submits a forged POST request to the vulnerable AJAX endpoint of the target WordPress site. When the victim visits the attacker's page while logged in, their browser attaches session cookies to the cross-origin request. The server executes insert_inner_template and creates the attacker-supplied Elementor template. Impact is limited to integrity of template data on the site, without direct confidentiality or availability effects.
No public proof-of-concept exploit or entries on CISA KEV are associated with this CVE at the time of writing. Refer to the Wordfence Vulnerability Report and CleanTalk CVE Analysis for additional technical context.
Detection Methods for CVE-2025-14163
Indicators of Compromise
- Unexpected Elementor templates appearing in the WordPress wp_posts table with post_type values related to Elementor library entries.
- HTTP POST requests to admin-ajax.php invoking the plugin's template insertion action from external Referer headers not matching the site's admin URL.
- Template creation events attributed to administrator or editor accounts outside of normal editing sessions.
Detection Strategies
- Review web server access logs for POST requests to wp-admin/admin-ajax.php where the action parameter targets the Premium Addons template manager and the Referer header points to an untrusted origin.
- Correlate WordPress audit logs with browser session activity to identify template creations that lack a corresponding admin UI navigation trail.
- Compare the installed plugin version against 4.11.53 and flag hosts still running vulnerable builds.
Monitoring Recommendations
- Enable a WordPress activity logging plugin to track Elementor template creation events with source IP and referer metadata.
- Alert on inbound requests to admin-ajax.php carrying cross-origin Referer values from authenticated sessions.
- Monitor plugin inventory across managed WordPress fleets and generate tickets for any host running Premium Addons for Elementor at or below 4.11.53.
How to Mitigate CVE-2025-14163
Immediate Actions Required
- Update Premium Addons for Elementor to the version released after 4.11.53 that introduces nonce validation on the insert_inner_template function.
- Audit the Elementor template library for unrecognized entries created since the plugin was installed and remove suspicious templates.
- Notify administrators and editors of the CSRF risk and instruct them to log out of WordPress before browsing untrusted sites.
Patch Information
The vendor leap13 published the fix through the WordPress plugin repository. The corrective code changes are documented in the WordPress Change Set 3416254. Review the pre-patch source at the WordPress Plugin Code Review reference to confirm the missing nonce check in the affected release.
Workarounds
- Deactivate the Premium Addons for Elementor plugin until the patched version can be installed.
- Restrict the edit_posts capability to a minimal set of trusted accounts and require those accounts to use isolated browser profiles for WordPress administration.
- Deploy a web application firewall rule that blocks POST requests to admin-ajax.php targeting the plugin's template action when the Referer header does not match the site's own admin origin.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
