CVE-2025-12778CWE-862broken-access-control

CVE-2025-12778

Medium · published November 20, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
16.2
In the wild
Unconfirmed
What it is

The Ultimate Member Widgets for Elementor – WordPress User Directory plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the handle_filter_users function in all versions up to, and including, 2.3. This makes it possible for unauthenticated attackers to extract partial metadata of all WordPress users, including their first name, last name and email addresses.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00256 · 16.2th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-11-20T20:17Z
References (2)
https://plugins.trac.wordpress.org/changeset/3397029/ultimate-member-widgets-for-elementor · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/a917a24b-09cc-48e9-844a-e1ed573a708f?source=cve · [email protected]
EPSS history
Timeline
  • 20 NOV 04:37Z
    Ultimate Member Widgets for Elementor <= 2.3 - Missing Authorization to Unauthenticated Information Exposure
    cvelistv5