CVE-2025-11997 is an information exposure vulnerability in the Document Pro Elementor – Documentation & Knowledge Base WordPress plugin (versions up to 1.0.9). The plugin improperly exposes sensitive Algolia API keys through frontend JavaScript by using wp_localize_script without enforcing access controls. This exposure allows unauthenticated attackers to extract these keys from the page source and potentially abuse the Algolia API configured by the plugin. The vulnerability is rated medium severity with a CVSS score of 5.3 and is tracked under CWE-200.

Exposure of Algolia API keys to unauthorized actors can lead to unauthorized API usage, which may result in data leakage or abuse of the Algolia search service associated with the affected plugin. There is no indication of direct impact on confidentiality, integrity, or availability of the WordPress site itself, but the exposed keys could be misused externally. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid exposing sensitive API keys in frontend code or consider removing or disabling the affected plugin version. Monitoring for updates from the vendor or plugin author is recommended to apply an official fix once released.