CVE-2025-2228: Elementor Addons Information Disclosure Flaw

CVE-2025-2228 Overview

CVE-2025-2228 affects the Responsive Addons for Elementor plugin for WordPress, developed by Cyberchimps. The vulnerability exists in the register_user function across all versions up to and including 1.6.8. Authenticated attackers with Contributor-level access or higher can extract sensitive data, including usernames and passwords, of users who register through the Edit Login | Registration Form widget. Exploitation requires the registered user to open the email notification sent upon successful registration. The flaw is classified as Sensitive Information Exposure under [CWE-200].

Critical Impact
Attackers with low-privilege accounts can harvest plaintext credentials of newly registered users, enabling account takeover and lateral movement across WordPress sites.

Affected Products

Cyberchimps Responsive Addons for Elementor (WordPress plugin)
All versions up to and including 1.6.8
Sites using the Edit Login | Registration Form widget

Discovery Timeline

2025-03-26 - CVE-2025-2228 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2228

Vulnerability Analysis

The vulnerability resides in the register_user function within class-login-register.php of the Responsive Addons for Elementor plugin. When a new user registers through the Edit Login | Registration Form widget, the plugin generates an email notification confirming successful registration. The notification exposes sensitive registration data, including the username and password submitted during registration. Any authenticated user with Contributor-level access or higher can leverage plugin functionality to extract this data. The exposure creates a credential harvesting path that bypasses the expected confidentiality boundary between low-privileged contributors and the credentials of other site users.

Root Cause

The root cause is insufficient access control and unsafe handling of credential data during the user registration workflow. The plugin stores or transmits registration data in a manner accessible to lower-privileged authenticated roles. The register_user handler does not adequately restrict which users can view or retrieve registration output. This design flaw maps to [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Attack Vector

Exploitation requires an attacker to already hold a Contributor account or higher on the target WordPress site. The attacker waits for a legitimate user to register through the Edit Login | Registration Form widget. Once the new user opens the successful registration email notification, the attacker can retrieve the exposed credentials through the vulnerable plugin function. The attack vector is network-based and requires user interaction from the registering victim. For technical details, review the WordPress Plugin Code Review and the Wordfence Vulnerability Report.

No public proof-of-concept exploit code is available for this vulnerability at this time.

Detection Methods for CVE-2025-2228

Indicators of Compromise

Unexpected account takeover events for users who recently registered through the Edit Login | Registration Form widget.
Contributor or Author accounts accessing plugin endpoints related to login-register functionality outside normal editorial workflows.
Anomalous authentication events from IP addresses tied to low-privileged WordPress accounts.

Detection Strategies

Audit WordPress activity logs for Contributor-level users interacting with Responsive Addons for Elementor registration components.
Monitor WordPress wp_users and wp_usermeta tables for password resets or logins immediately following registration events.
Correlate registration email delivery timestamps with subsequent authentication activity from unfamiliar sources.

Monitoring Recommendations

Enable comprehensive WordPress audit logging for user registration and role assignment events.
Track outbound email volume and content patterns from the WordPress mail subsystem for registration notifications.
Alert on any Contributor account issuing requests to plugin AJAX or REST endpoints associated with the login-register module.

How to Mitigate CVE-2025-2228

Immediate Actions Required

Update the Responsive Addons for Elementor plugin to a version later than 1.6.8 immediately.
Audit all Contributor-level and higher accounts on affected WordPress sites for legitimacy.
Force password resets for any users who registered through the affected widget while the vulnerable version was active.

Patch Information

Cyberchimps addressed the vulnerability in a release following version 1.6.8. The fix is documented in WordPress Changeset #3261241. Administrators should apply the update through the WordPress plugin management interface or via WP-CLI. Verify the installed version after patching to confirm remediation.

Workarounds

Disable the Edit Login | Registration Form widget until the plugin is patched.
Restrict Contributor-level account provisioning and review existing low-privileged accounts for necessity.
Deactivate the Responsive Addons for Elementor plugin entirely if the registration widget is business-critical and cannot be disabled independently.

bash

# Update the plugin using WP-CLI
wp plugin update responsive-addons-for-elementor

# Verify installed version
wp plugin get responsive-addons-for-elementor --field=version

# Temporarily deactivate the plugin if patching is delayed
wp plugin deactivate responsive-addons-for-elementor