Unauthorized Data Access in the Ultimate Member Widgets for Elementor by WordPress
CVE-2025-12778

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Ultimate Member Widgets For Elementor – WordPress User Directory
Vendor
CVE Published:
20 November 2025

What is CVE-2025-12778?

The Ultimate Member Widgets for Elementor plugin, designed for WordPress user directories, suffers from a significant security issue caused by a missing capability check in the handle_filter_users function. This vulnerability allows unauthenticated attackers to gain access to partial metadata of all WordPress users, including sensitive information such as first names, last names, and email addresses, thereby posing a serious risk to user privacy and data security.

Affected Version(s)

Ultimate Member Widgets for Elementor – WordPress User Directory * <= 2.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3397029/ulti...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Powpy
JSON
.