CVE-2025-11997

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11997", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-20T20:47:48.546Z", "datePublished": "2025-11-11T03:30:39.666Z", "dateUpdated": "2026-04-08T16:55:14.555Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:55:14.555Z"}, "affected": [{"vendor": "ngothoai", "product": "Document Pro Elementor \u2013 Documentation & Knowledge Base", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Document Pro Elementor \u2013 Documentation & Knowledge Base plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.9. This is due to the plugin exposing sensitive Algolia API keys through the frontend JavaScript code via wp_localize_script without proper access restrictions. This makes it possible for unauthenticated attackers to view sensitive API keys in the page source, which could be leveraged to make unauthorized API calls to the configured Algolia search service."}], "title": "Document Pro Elementor \u2013 Documentation & Knowledge Base <= 1.0.9 - Unauthenticated Information Exposure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5ac7455a-0c89-4f5b-84eb-b7cc87bce8d4?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/document-pro-elementor/tags/1.0.9/inc/Base/DPET_Enqueue.php#L85"}, {"url": "https://plugins.trac.wordpress.org/browser/document-pro-elementor/tags/1.0.9/inc/Base/DPET_Enqueue.php#L71"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "cweId": "CWE-200", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "timeline": [{"time": "2025-11-10T14:50:40.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-12T16:04:33.713154Z", "id": "CVE-2025-11997", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-12T20:07:05.268Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11997", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-12T16:04:33.713154Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-12T16:04:56.740Z"}}], "cna": {"title": "Document Pro Elementor \u2013 Documentation & Knowledge Base <= 1.0.9 - Unauthenticated Information Exposure", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "ngothoai", "product": "Document Pro Elementor \u2013 Documentation & Knowledge Base", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.9"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-10T14:50:40.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5ac7455a-0c89-4f5b-84eb-b7cc87bce8d4?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/document-pro-elementor/tags/1.0.9/inc/Base/DPET_Enqueue.php#L85"}, {"url": "https://plugins.trac.wordpress.org/browser/document-pro-elementor/tags/1.0.9/inc/Base/DPET_Enqueue.php#L71"}], "descriptions": [{"lang": "en", "value": "The Document Pro Elementor \u2013 Documentation & Knowledge Base plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.9. This is due to the plugin exposing sensitive Algolia API keys through the frontend JavaScript code via wp_localize_script without proper access restrictions. This makes it possible for unauthenticated attackers to view sensitive API keys in the page source, which could be leveraged to make unauthorized API calls to the configured Algolia search service."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:55:14.555Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11997", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:55:14.555Z", "dateReserved": "2025-10-20T20:47:48.546Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-11T03:30:39.666Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Document Pro Elementor \u2013 Documentation & Knowledge Base", "vendor": "ngothoai", "versions": [{"lessThanOrEqual": "1.0.9", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Document Pro Elementor \u2013 Documentation & Knowledge Base plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.9. This is due to the plugin exposing sensitive Algolia API keys through the frontend JavaScript code via wp_localize_script without proper access restrictions. This makes it possible for unauthenticated attackers to view sensitive API keys in the page source, which could be leveraged to make unauthorized API calls to the configured Algolia search service."}, {"lang": "es", "value": "El plugin Document Pro Elementor - Documentation & Knowledge Base para WordPress es vulnerable a la Exposici\u00f3n de Informaci\u00f3n en todas las versiones hasta la 1.0.9, inclusive. Esto se debe a que el plugin expone claves API sensibles de Algolia a trav\u00e9s del c\u00f3digo JavaScript del frontend mediante wp_localize_script sin las restricciones de acceso adecuadas. Esto permite a atacantes no autenticados ver claves API sensibles en el c\u00f3digo fuente de la p\u00e1gina, lo que podr\u00eda aprovecharse para realizar llamadas a la API no autorizadas al servicio de b\u00fasqueda de Algolia configurado."}], "id": "CVE-2025-11997", "lastModified": "2026-10-07T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11997", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-12T16:04:33.713154Z", "version": "2.0.3"}}]}, "published": "2025-11-11T04:15:45.293", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/document-pro-elementor/tags/1.0.9/inc/Base/DPET_Enqueue.php#L71"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/document-pro-elementor/tags/1.0.9/inc/Base/DPET_Enqueue.php#L85"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5ac7455a-0c89-4f5b-84eb-b7cc87bce8d4?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T12:26:42.099982+00:00", "value": {"mitigation_remediation": ["Upgrade the Document Pro Elementor plugin to a version newer than 1.0.9, which removes the Algolia API keys from public JavaScript.", "If an upgrade is not feasible, modify the DPET_Enqueue.php file to stop passing the sensitive keys to wp_localize_script, or alter the logic to expose keys only to authenticated users.", "Verify that no Algolia API keys appear in any publicly served JavaScript files and monitor the Algolia service logs for unexpected or unauthenticated API usage."], "summary": {"action": "Update Plugin", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "All installations of the Document Pro Elementor \u2013 Documentation & Knowledge Base plugin with versions 1.0.9 or earlier are affected. The vulnerability exists in the WordPress plugin listing for ngothoai on Trac, and it is present in the code paths that enqueue scripts from the DPET_Enqueue.php file.", "description_and_impact": "The Document Pro Elementor \u2013 Documentation & Knowledge Base plugin for WordPress leaks sensitive Algolia API keys through its front\u2011end JavaScript code, bypassing any access restrictions. An attacker who can view the page source can capture these keys and use them to make unauthorized calls to the configured Algolia search service. This flaw allows unauthenticated disclosure of credentials that could facilitate further manipulation of the search index or data extraction.", "risk_and_exploitability": "The CVSS score of 5.3 indicates medium severity, and the EPSS score of less than 1% suggests a low probability of exploitation at the time of analysis. The flaw is not currently listed in the CISA KEV catalog, but because the exposure is through public JavaScript, any user who visits a page that loads the plugin can retrieve the keys. Attackers do not need authenticated access, making the attack vector broad and straightforward\u2014simply accessing a page that includes the plugin\u2019s front\u2011end assets."}}}}, "created": "2025-11-12T12:47:36.260582+00:00", "updated": "2026-04-22T12:30:16.835468+00:00", "vendors": ["elementor", "elementor$PRODUCT$elementor", "ngothoai", "ngothoai$PRODUCT$document_pro_elementor", "wordpress", "wordpress$PRODUCT$wordpress"]}