Information Exposure Vulnerability in Phlox Theme Plugin for WordPress
CVE-2025-13215

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Shortcodes And Extra Features For Phlox Theme
Vendor
CVE Published:
6 January 2026

What is CVE-2025-13215?

The Phlox theme plugin for WordPress, specifically the auxels_ajax_search feature, allows unauthenticated users to exploit the plugin due to inadequate restrictions. This vulnerability enables attackers to access and extract titles of draft posts that should remain confidential, thereby posing a significant risk to user privacy and content integrity. It is crucial for users to update their plugins to mitigate this risk.

Affected Version(s)

Shortcodes and extra features for Phlox theme 0 <= 2.17.13

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/auxin-elements...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen C
.