PT-2026-1416 · WordPress · Phlox Theme

Nguyen C · Published 2026-01-06 · Updated 2026-01-06 · CVE-2025-13215

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Phlox Theme plugin for WordPress versions through 2.17.13

Description The Shortcodes and extra features for Phlox theme plugin for WordPress is susceptible to information disclosure. This issue affects the auxels ajax search component due to inadequate restrictions on post inclusion. An unauthenticated attacker can potentially extract titles of draft posts that they are not authorized to view.

Recommendations Update the Phlox Theme plugin to a version beyond 2.17.13.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-13215

Affected Products

Phlox Theme

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-13215 · Security Note
• https://twitter.com/VulmonFeeds/status/2008471512571875778 · Twitter Post
• https://twitter.com/CVEnew/status/2008439726810767768 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/7f47ab91-7d91-4231-91ef-66c556ad8496?source=cve · Note
• https://plugins.trac.wordpress.org/browser/auxin-elements/tags/2.17.12/public/includes/frontend-ajax.php#L348 · Note
• https://t.me/CVEtracker/41481 · Telegram Post
• https://t.me/cveNotify/147805 · Telegram Post