CVE-2025-12778 — Vulnerability intelligence

userelements — Ultimate Member Widgets for Elementor – WordPress User Directory

Published: 2025-11-20T04:37:14.431Z

CVSS

5.3

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

The Ultimate Member Widgets for Elementor – WordPress User Directory plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the handle_filter_users function in all versions up to, and including, 2.3. This makes it possible for unauthenticated attackers to extract partial metadata of all WordPress users, including their first name, last name and email addresses.

Sources

• CVE-2025-12778
• Original advisory
• Original advisory
• CVE-2025-12778