Security Advisory

CVE-2025-12778

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2025-11-20 04:37:14

Last updated 2026-04-08 17:14:03

Assigner Wordfence

State PUBLISHED

Description

The Ultimate Member Widgets for Elementor – WordPress User Directory plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the handle_filter_users function in all versions up to, and including, 2.3. This makes it possible for unauthenticated attackers to extract partial metadata of all WordPress users, including their first name, last name and email addresses.

← Browse all CVEs View on cve.org ↗