CVE-2025-68494: Leap13 Premium Addons Information Disclosure

CVE-2025-68494 Overview

CVE-2025-68494 is a Sensitive Data Exposure vulnerability affecting the Premium Addons for Elementor WordPress plugin developed by Leap13. This vulnerability allows unauthorized actors to retrieve embedded sensitive system information from affected WordPress installations. The flaw stems from improper exposure of sensitive system information to an unauthorized control sphere, enabling attackers to access confidential data without authentication.

Critical Impact

Unauthenticated attackers can remotely access sensitive system information embedded within the WordPress installation, potentially exposing configuration details, internal paths, or other confidential data that could facilitate further attacks.

Affected Products

• Leap13 Premium Addons for Elementor versions up to and including 4.11.53
• WordPress sites using vulnerable versions of the premium-addons-for-elementor plugin
• All WordPress installations with the affected plugin regardless of WordPress core version

Discovery Timeline

• 2025-12-24 - CVE-2025-68494 published to NVD
• 2026-04-27 - Last updated in NVD database

Technical Details for CVE-2025-68494

Vulnerability Analysis

This vulnerability is classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). The Premium Addons for Elementor plugin fails to properly restrict access to sensitive system information, allowing unauthenticated users to retrieve embedded data that should be protected. The vulnerability can be exploited remotely over the network without requiring any user interaction or special privileges.

The attack surface is significant given that Premium Addons for Elementor is a popular WordPress plugin used on numerous websites to extend Elementor page builder functionality. The information exposed could include internal system paths, configuration details, or other data that attackers could leverage for reconnaissance or subsequent attacks.

Root Cause

The root cause of this vulnerability lies in inadequate access controls within the plugin's codebase. The plugin exposes system information through endpoints or functionality that does not properly validate whether the requesting user has authorization to access such data. This represents a fundamental violation of the principle of least privilege, where sensitive information should only be accessible to authenticated and authorized users.

Attack Vector

The vulnerability can be exploited remotely via network access. An attacker does not require authentication credentials or any special privileges to exploit this flaw. The attack can be conducted without user interaction, making it particularly dangerous for publicly accessible WordPress sites.

Attackers can leverage this vulnerability by sending crafted requests to the vulnerable plugin components to extract sensitive system information. This information could then be used to:

• Identify internal server configurations and paths
• Gather intelligence for crafting more targeted attacks
• Discover additional vulnerabilities or misconfigurations
• Plan privilege escalation or lateral movement strategies

Detection Methods for CVE-2025-68494

Indicators of Compromise

• Unusual or excessive requests to plugin-specific endpoints associated with Premium Addons for Elementor
• Access logs showing attempts to retrieve configuration or system information files
• Unexpected data exfiltration patterns from the WordPress installation
• Reconnaissance activity targeting Elementor plugin directories and endpoints

Detection Strategies

• Monitor web server access logs for suspicious requests targeting /wp-content/plugins/premium-addons-for-elementor/ paths
• Implement Web Application Firewall (WAF) rules to detect information disclosure attack patterns
• Use WordPress security plugins to monitor for unauthorized data access attempts
• Review plugin-specific API endpoints for unexpected access patterns

Monitoring Recommendations

• Enable detailed logging on WordPress installations using the affected plugin
• Configure alerts for unusual request volumes to plugin endpoints
• Implement real-time monitoring of sensitive file and endpoint access
• Regularly audit access logs for reconnaissance patterns targeting plugin functionality

How to Mitigate CVE-2025-68494

Immediate Actions Required

• Update Premium Addons for Elementor to the latest patched version immediately
• Review WordPress access logs for any signs of prior exploitation
• Conduct a security audit of exposed system information on affected installations
• Consider temporarily disabling the plugin if an immediate update is not possible

Patch Information

Leap13 has addressed this vulnerability in versions of Premium Addons for Elementor released after 4.11.53. Website administrators should update to the latest version available through the WordPress plugin repository. For detailed patch information and vulnerability specifics, refer to the Patchstack Vulnerability Report.

Workarounds

• If immediate patching is not possible, consider temporarily deactivating the Premium Addons for Elementor plugin
• Implement Web Application Firewall rules to block suspicious requests to plugin endpoints
• Restrict access to the WordPress admin area and plugin directories using server-level controls
• Enable additional authentication layers for sensitive WordPress functionality

# WordPress CLI command to check plugin version
wp plugin get premium-addons-for-elementor --fields=name,version,update_version

# Update the plugin via WP-CLI
wp plugin update premium-addons-for-elementor