« Volver al listado

CVE-2025-14434

Estado: AplazadaMedia (5.3)—

The Ultimate Post Kit Addons for Elementor WordPress plugin before 4.0.16 exposes multiple AJAX “load more” endpoints such as upk_alex_grid_loadmore_posts without ensuring that posts to be displayed are published authentication. This allows an unauthenticated attacker to query arbitrary posts and retrieve rendered HTML content of private and unpublished ones.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Ultimate Post KIT — Ultimate Post KITAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-14434",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-14434",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-02T14:20:43.862087Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "contact@wpscan.com",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "Ultimate Post Kit Addons for Elementor",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.0.16",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-12-31T06:15:40.410",
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/bf3c3193-fc9c-454b-ad4f-94ba1669a312/",
      "source": "contact@wpscan.com"
    },
    {
      "url": "https://wpscan.com/vulnerability/bf3c3193-fc9c-454b-ad4f-94ba1669a312/",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "The Ultimate Post Kit Addons for Elementor WordPress plugin before 4.0.16 exposes multiple AJAX “load more” endpoints such as upk_alex_grid_loadmore_posts without ensuring that posts to be displayed are published authentication. This allows an unauthenticated attacker to query arbitrary posts and retrieve rendered HTML content of private and unpublished ones."
    },
    {
      "lang": "es",
      "value": "El plugin de WordPress Ultimate Post Kit Addons for Elementor, en versiones anteriores a la 4.0.16, expone múltiples endpoints AJAX de 'cargar más' como upk_alex_grid_loadmore_posts sin asegurar que las publicaciones a mostrar sean autenticación publicada. Esto permite a un atacante no autenticado consultar publicaciones arbitrarias y recuperar el contenido HTML renderizado de publicaciones privadas y no publicadas."
    }
  ],
  "lastModified": "2026-06-17T08:35:55.390",
  "sourceIdentifier": "contact@wpscan.com"
}