Responsive Addons for Elementor Plugin up to 1.6.8 on WordPress register_user information disclosure

Summaryinfo

A vulnerability has been found in Responsive Addons for Elementor Plugin up to 1.6.8 on WordPress and classified as problematic. Affected by this vulnerability is the function register_user. The manipulation leads to information disclosure. This vulnerability is uniquely identified as CVE-2025-2228. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Responsive Addons for Elementor Plugin up to 1.6.8 on WordPress. This issue affects the function register_user. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. The summary by CVE is:

The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.8 the 'register_user' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including usernames and passwords of any users who register via the Edit Login | Registration Form widget, as long as that user opens the email notification for successful registration.

It is possible to read the advisory at wordfence.com. The identification of this vulnerability is CVE-2025-2228 since 03/11/2025. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Name

• Responsive Addons for Elementor Plugin

Version

• 1.6.0
• 1.6.1
• 1.6.2
• 1.6.3
• 1.6.4
• 1.6.5
• 1.6.6
• 1.6.7
• 1.6.8

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion