What is CVE-2025-6253?

CVE-2025-6253 is a high-severity vulnerability in Uicore Elements – Free Widgets And Templates For Elementor, classified under Missing Authorization. CVSS score: 7.5/10. Published 2025-08-12.

How severe is CVE-2025-6253?

High severity. CVSS v3 base score is 7.5 out of 10.

Auth bypass in Uicore Elements – Free Widgets And Templates For Elementor

CVE-2025-6253

The UiCore Elements – Free Elementor widgets and templates plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.3.0 via the prepare_template() function due to a missing capability check and insufficient controls on the filename specified. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

Vulnerability class: Broken Access Control

EPSS: 0.004 (31.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Uicore Elements – Free Widgets And Templates For Elementor — versions 0

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

Frequently asked questions

What is CVE-2025-6253?: CVE-2025-6253 is a high-severity vulnerability in Uicore Elements – Free Widgets And Templates For Elementor, classified under Missing Authorization. CVSS score: 7.5/10. Published 2025-08-12.
How severe is CVE-2025-6253?: High severity. CVSS v3 base score is 7.5 out of 10.