PT-2026-27061 · Elementor+4 · Elementor+4

Ulyses Saicha · Publicado 2026-03-23 · Atualizado 2026-03-23 · CVE-2025-13997

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions King Addons for Elementor versions through 51.1.49

Description The King Addons for Elementor plugin for WordPress is susceptible to unauthenticated disclosure of API keys. The plugin adds API keys to the HTML source code through the render full form function, potentially allowing unauthenticated attackers to extract Mailchimp, Facebook, and Google API keys and secrets. This requires a Premium license to be installed. Reports indicate offensive activities targeting this issue.

Recommendations Versions prior to and including 51.1.49 should be updated.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2025-13997

Produtos afetados

Elementor

Facebook

Google

Qi Addons For Elementor

Mailchimp

Referências · 6

• https://twitter.com/CVEnew/status/2035992464687767915 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-13997 · Nota de Segurança
• https://twitter.com/CVEarity/status/2036120386941886522 · Publicação no Twitter
• https://twitter.com/vuldb/status/2036214301758013466 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/king-addons/tags/51.1.38/includes/widgets/Login_Register_Form/Login_Register_Form.php#L3065 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/7955b162-ed0f-4455-a429-ed292771c701?source=cve · Nota