PT-2025-47555 · WordPress+1 · Ultimate Member Widgets For Elementor+1

Powpy · Published 2025-11-20 · Updated 2025-11-20 · CVE-2025-12778

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Ultimate Member Widgets for Elementor – WordPress User Directory plugin versions prior to 2.3

Description The plugin is susceptible to unauthorized data access because of a missing capability check within the handle filter users function. This allows unauthenticated attackers to retrieve partial metadata of all WordPress users, specifically their first name, last name, and email addresses.

Recommendations Update to a version later than 2.3.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-12778

Affected Products

Elementor

Ultimate Member Widgets For Elementor

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-12778 · Security Note
• https://twitter.com/VulmonFeeds/status/1991609330571878575 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/a917a24b-09cc-48e9-844a-e1ed573a708f?source=cve · Note
• https://twitter.com/CVEnew/status/1991409442198339851 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3397029/ultimate-member-widgets-for-elementor · Note
• https://t.me/CVEtracker/37813 · Telegram Post