Unauthorized Data Access in the Ultimate Member Widgets for Elementor by WordPress
CVE-2025-12778
5.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 20 November 2025
What is CVE-2025-12778?
The Ultimate Member Widgets for Elementor plugin, designed for WordPress user directories, suffers from a significant security issue caused by a missing capability check in the handle_filter_users function. This vulnerability allows unauthenticated attackers to gain access to partial metadata of all WordPress users, including sensitive information such as first names, last names, and email addresses, thereby posing a serious risk to user privacy and data security.
Affected Version(s)
Ultimate Member Widgets for Elementor – WordPress User Directory * <= 2.3