{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14155", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-05T20:29:05.837Z", "datePublished": "2025-12-23T09:19:59.928Z", "dateUpdated": "2026-04-08T16:36:38.336Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:36:38.336Z"}, "affected": [{"vendor": "leap13", "product": "Premium Addons for Elementor \u2013 Powerful Elementor Templates & Widgets", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.11.53", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Premium Addons for Elementor \u2013 Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_template_content' function in all versions up to, and including, 4.11.53. This makes it possible for unauthenticated attackers to view the content of private, draft, and pending templates."}], "title": "Premium Addons for Elementor <= 4.11.53 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'get_template_content'", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/135c33bb-5ec2-4697-9340-1d2651ff3a0b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/tags/4.11.53/includes/addons-integration.php#L1624"}, {"url": "https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/tags/4.11.53/includes/addons-integration.php#L90"}, {"url": "https://plugins.trac.wordpress.org/changeset/3416254/"}, {"url": "https://research.cleantalk.org/cve-2025-14155/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "timeline": [{"time": "2025-12-22T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-23T15:29:29.322475Z", "id": "CVE-2025-14155", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-23T15:29:36.524Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14155", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-23T15:29:29.322475Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-23T15:29:32.248Z"}}], "cna": {"title": "Premium Addons for Elementor <= 4.11.53 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'get_template_content'", "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "leap13", "product": "Premium Addons for Elementor \u2013 Powerful Elementor Templates & Widgets", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.11.53"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-22T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/135c33bb-5ec2-4697-9340-1d2651ff3a0b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/tags/4.11.53/includes/addons-integration.php#L1624"}, {"url": "https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/tags/4.11.53/includes/addons-integration.php#L90"}, {"url": "https://plugins.trac.wordpress.org/changeset/3416254/"}, {"url": "https://research.cleantalk.org/cve-2025-14155/"}], "descriptions": [{"lang": "en", "value": "The Premium Addons for Elementor \u2013 Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_template_content' function in all versions up to, and including, 4.11.53. This makes it possible for unauthenticated attackers to view the content of private, draft, and pending templates."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:36:38.336Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14155", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:36:38.336Z", "dateReserved": "2025-12-05T20:29:05.837Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-23T09:19:59.928Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:leap13:premium_addons_for_elementor:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "64CFC13B-0B7D-4AAA-946C-74E74ED44158", "versionEndExcluding": "4.11.54", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Premium Addons for Elementor \u2013 Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_template_content' function in all versions up to, and including, 4.11.53. This makes it possible for unauthenticated attackers to view the content of private, draft, and pending templates."}], "id": "CVE-2025-14155", "lastModified": "2026-04-08T17:20:24.867", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-12-23T10:15:43.297", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/tags/4.11.53/includes/addons-integration.php#L1624"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/tags/4.11.53/includes/addons-integration.php#L90"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3416254/"}, {"source": "security@wordfence.com", "url": "https://research.cleantalk.org/cve-2025-14155/"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/135c33bb-5ec2-4697-9340-1d2651ff3a0b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T20:18:35.869270+00:00", "value": {"mitigation_remediation": ["Update the Premium Addons for Elementor plugin to a version newer than 4.11.53, which removes the missing capability check in get_template_content.", "If an immediate upgrade is not feasible, restrict unauthenticated access to the get_template_content endpoint, for example by adding a capability requirement through a WordPress hook or blocking the request via .htaccess rules.", "Ensure that all Elementor templates are set to private or unpublished when they are not intended for public viewing and periodically audit template visibility settings to verify they have not been exposed unintentionally."], "summary": {"action": "Apply Patch", "impact": "Unauthorized Sensitive Information Exposure"}, "threat_synthesis": {"affected_systems": "WordPress installations that have the leap13 Premium Addons for Elementor plugin installed, specifically any version up to and including 4.11.53, are affected. Installations using newer versions of the plugin are not impacted.", "description_and_impact": "The Premium Addons for Elementor plugin contains a flaw in its get_template_content function where a required capability check is missing. Because this check is not performed, any visitor to the site can request the content of templates that are marked as private, draft or pending. The flaw therefore allows the disclosure of confidential design details and metadata stored in these templates, compromising the confidentiality of template data.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a moderate severity level for this vulnerability. The EPSS score is reported as less than 1%, suggesting that the likelihood of exploitation is currently low. The vulnerability is not listed in CISA's KEV catalog, and no publicly documented exploits exist as of the available information. An attacker can typically trigger the flaw by sending a simple HTTP request to the endpoint that invokes get_template_content, making the attack vector remote and unauthenticated. Since the flaw permits disclosure rather than privilege escalation, the impact is limited to information leakage."}}}}, "created": "2025-12-23T22:39:39.767875+00:00", "updated": "2026-04-22T20:30:26.768641+00:00", "vendors": ["elementor", "elementor$PRODUCT$elementor", "leap13", "leap13$PRODUCT$premium_addons", "leap13$PRODUCT$premium_addons_for_elementor", "wordpress", "wordpress$PRODUCT$wordpress"]}