CVE-2025-68494: Leap13 Premium Addons Information Disclosure

CVE-2025-68494 Overview

CVE-2025-68494 is a Sensitive Data Exposure vulnerability affecting the Premium Addons for Elementor WordPress plugin developed by Leap13. This vulnerability allows unauthorized actors to retrieve embedded sensitive system information from affected WordPress installations. The flaw stems from improper exposure of sensitive system information to an unauthorized control sphere, enabling attackers to access confidential data without authentication.

Critical Impact
Unauthenticated attackers can remotely access sensitive system information embedded within the WordPress installation, potentially exposing configuration details, internal paths, or other confidential data that could facilitate further attacks.

Affected Products

Leap13 Premium Addons for Elementor versions up to and including 4.11.53
WordPress sites using vulnerable versions of the premium-addons-for-elementor plugin
All WordPress installations with the affected plugin regardless of WordPress core version

Discovery Timeline

2025-12-24 - CVE-2025-68494 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2025-68494

Vulnerability Analysis

This vulnerability is classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). The Premium Addons for Elementor plugin fails to properly restrict access to sensitive system information, allowing unauthenticated users to retrieve embedded data that should be protected. The vulnerability can be exploited remotely over the network without requiring any user interaction or special privileges.

The attack surface is significant given that Premium Addons for Elementor is a popular WordPress plugin used on numerous websites to extend Elementor page builder functionality. The information exposed could include internal system paths, configuration details, or other data that attackers could leverage for reconnaissance or subsequent attacks.

Root Cause

The root cause of this vulnerability lies in inadequate access controls within the plugin's codebase. The plugin exposes system information through endpoints or functionality that does not properly validate whether the requesting user has authorization to access such data. This represents a fundamental violation of the principle of least privilege, where sensitive information should only be accessible to authenticated and authorized users.

Attack Vector

The vulnerability can be exploited remotely via network access. An attacker does not require authentication credentials or any special privileges to exploit this flaw. The attack can be conducted without user interaction, making it particularly dangerous for publicly accessible WordPress sites.

Attackers can leverage this vulnerability by sending crafted requests to the vulnerable plugin components to extract sensitive system information. This information could then be used to:

Identify internal server configurations and paths
Gather intelligence for crafting more targeted attacks
Discover additional vulnerabilities or misconfigurations
Plan privilege escalation or lateral movement strategies

Detection Methods for CVE-2025-68494

Indicators of Compromise

Unusual or excessive requests to plugin-specific endpoints associated with Premium Addons for Elementor
Access logs showing attempts to retrieve configuration or system information files
Unexpected data exfiltration patterns from the WordPress installation
Reconnaissance activity targeting Elementor plugin directories and endpoints

Detection Strategies

Monitor web server access logs for suspicious requests targeting /wp-content/plugins/premium-addons-for-elementor/ paths
Implement Web Application Firewall (WAF) rules to detect information disclosure attack patterns
Use WordPress security plugins to monitor for unauthorized data access attempts
Review plugin-specific API endpoints for unexpected access patterns

Monitoring Recommendations

Enable detailed logging on WordPress installations using the affected plugin
Configure alerts for unusual request volumes to plugin endpoints
Implement real-time monitoring of sensitive file and endpoint access
Regularly audit access logs for reconnaissance patterns targeting plugin functionality

How to Mitigate CVE-2025-68494

Immediate Actions Required

Update Premium Addons for Elementor to the latest patched version immediately
Review WordPress access logs for any signs of prior exploitation
Conduct a security audit of exposed system information on affected installations
Consider temporarily disabling the plugin if an immediate update is not possible

Patch Information

Leap13 has addressed this vulnerability in versions of Premium Addons for Elementor released after 4.11.53. Website administrators should update to the latest version available through the WordPress plugin repository. For detailed patch information and vulnerability specifics, refer to the Patchstack Vulnerability Report.

Workarounds

If immediate patching is not possible, consider temporarily deactivating the Premium Addons for Elementor plugin
Implement Web Application Firewall rules to block suspicious requests to plugin endpoints
Restrict access to the WordPress admin area and plugin directories using server-level controls
Enable additional authentication layers for sensitive WordPress functionality

bash

# WordPress CLI command to check plugin version
wp plugin get premium-addons-for-elementor --fields=name,version,update_version

# Update the plugin via WP-CLI
wp plugin update premium-addons-for-elementor