CVE-2025-13215 affects the Shortcodes and extra features for Phlox theme WordPress plugin, allowing unauthenticated attackers to retrieve titles of draft posts they should not access. The vulnerability arises from inadequate restrictions in the auxels_ajax_search feature, leading to exposure of sensitive information. It impacts all versions up to and including 2.17.13. The CVSS 3.1 score of 5.3 reflects a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No patch or official remediation guidance has been provided by the vendor as of the published date.

An attacker without authentication can obtain the titles of draft posts that are intended to be private, potentially revealing sensitive or confidential information. There is no impact on integrity or availability reported. The exposure is limited to information disclosure of post titles only.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the auxels_ajax_search endpoint or disabling the affected plugin features if possible to reduce exposure.