CVE-2025-12778
BaseFortify
Publication date: 2025-11-20
Last updated on: 2025-11-20
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ultimate_member | widgets_for_elementor | * |
| wordpress | wordpress | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Ultimate Member Widgets for Elementor WordPress plugin, where a missing capability check in the handle_filter_users function allows unauthenticated attackers to access partial metadata of all WordPress users. Specifically, attackers can extract sensitive user information such as first name, last name, and email addresses without proper authorization. The issue arises because the plugin does not properly restrict access to user data in AJAX requests, exposing sensitive fields to the public. [1]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of personal user information including first name, last name, and email addresses. Such data exposure can facilitate phishing attacks, identity theft, spam, and other malicious activities targeting the users of the affected WordPress site. It compromises user privacy and can damage the reputation of the website owner. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability can negatively impact compliance with data protection regulations such as GDPR and HIPAA because it allows unauthorized access to personally identifiable information (PII) like names and email addresses. Exposure of such data without proper consent or security controls violates principles of data confidentiality and privacy mandated by these standards, potentially leading to legal and regulatory consequences. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if your WordPress installation is running the Ultimate Member Widgets for Elementor plugin version 2.3 or earlier. Additionally, monitoring AJAX requests to the endpoints 'wp_ajax_um_filter_users' and 'wp_ajax_nopriv_um_filter_users' for unauthorized access attempts to user metadata can help detect exploitation. For example, you can use the following command to search web server logs for suspicious AJAX requests: `grep 'wp_ajax_um_filter_users' /var/log/apache2/access.log` or `grep 'wp_ajax_nopriv_um_filter_users' /var/log/apache2/access.log`. Also, scanning for plugin versions can be done using WP-CLI: `wp plugin list --field=name,version | grep ultimate-member-widgets-for-elementor`. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Ultimate Member Widgets for Elementor plugin to version 2.4 or later, where the vulnerability is fixed by implementing proper capability checks and restricting sensitive user metadata exposure. If updating is not immediately possible, restrict access to the AJAX endpoints 'wp_ajax_um_filter_users' and 'wp_ajax_nopriv_um_filter_users' via firewall or web server rules to prevent unauthenticated access. Additionally, review and limit the user meta fields exposed in widget settings to exclude sensitive information. [1]