CVE-2025-0898

Vulnerability

The Xpro Elementor Addons - Pro plugin for WordPress, in all versions up to and including 1.4.7, contains an arbitrary file reading vulnerability in the Draw SVG widget. The vulnerability allows authenticated attackers with Contributor-level access or higher to read the contents of any file on the server, including sensitive information. [1]

Exploitation

An attacker must be authenticated to the WordPress site with at least Contributor-level permissions. The vulnerability resides in the Draw SVG widget, which can be abused to request arbitrary file paths. The exact sequence of steps involves using a crafted request to the widget to read files outside the intended scope, with no additional user interaction required beyond the authenticated session. [1]

Impact

Successful exploitation allows the attacker to read arbitrary files on the server, potentially exposing sensitive data such as configuration files, database credentials, or private content. The compromise is limited to file disclosure (confidentiality impact) and does not grant write or execution capabilities. The attacker gains access to server file contents but does not elevate their privilege level beyond the authenticated session. [1]

Mitigation

As of the publication date (2026-05-27), no patched version has been released. The vendor's official page does not mention a fix. Affected users should monitor the vendor's site for updates and consider restricting Contributor-level access until a patch is available. No known workaround is documented. [1]