Arbitrary File Read Vulnerability in UiCore Elements Plugin for WordPress

CVE-2025-6253

What is CVE-2025-6253?

The UiCore Elements plugin for WordPress, which provides free Elementor widgets and templates, has a security flaw that allows unauthorized users to exploit the prepare_template() function. Due to the absence of appropriate capability checks and lax controls on the filenames, attackers can potentially read sensitive files on the server. This vulnerability, present in all versions up to 1.3.0, poses a significant risk of exposing confidential information stored on the web server.

References