PT-2025-12886 · WordPress · Responsive Addons For Elementor

Wesley · Published 2025-03-26 · Updated 2025-03-26 · CVE-2025-2228

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress versions up to, and including, 1.6.8

Description The issue allows authenticated attackers with Contributor-level access and above to extract sensitive data, including usernames and passwords of users who register via the Edit Login | Registration Form widget, as long as the user opens the email notification for successful registration. This is possible due to the register user function.

Recommendations For versions up to, and including, 1.6.8, consider disabling the register user function until a patch is available to prevent exploitation. Restrict access to the Edit Login | Registration Form widget to minimize the risk of sensitive data exposure. Avoid using the widget for user registration until the issue is resolved.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-2228

Affected Products

Responsive Addons For Elementor

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-2228 · Security Note
• https://osv.dev/vulnerability/CVE-2025-2228 · Vendor Advisory
• https://twitter.com/CVEnew/status/1904881953926447526 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/659ef2e8-589c-4901-88ce-1d674c056ece?source=cve · Note
• https://t.me/cvetracker/19962 · Telegram Post
• https://t.me/cvenotify/116305 · Telegram Post
• https://t.me/cvedetector/21181 · Telegram Post
• https://plugins.trac.wordpress.org/browser/responsive-addons-for-elementor/trunk/includes/modules-manager/login-register/class-login-register.php#L369 · Note
• https://plugins.trac.wordpress.org/changeset/3261241 · Note