CVE-2025-6253 is a missing authorization vulnerability (CWE-862) in the UiCore Elements – Free Elementor widgets and templates WordPress plugin. The vulnerability arises from the prepare_template() function lacking a capability check and insufficient validation of the filename input, enabling unauthenticated attackers to perform arbitrary file reads on the server. This can expose sensitive data contained in server files. The vulnerability affects all versions up to and including 1.3.0. The CVSS 3.1 base score is 7.5 (high severity), reflecting network attack vector, no privileges required, no user interaction, and high confidentiality impact. There are no known exploits in the wild and no vendor-provided patch or fix at this time.

Successful exploitation allows unauthenticated attackers to read arbitrary files on the server hosting the vulnerable WordPress plugin. This can lead to exposure of sensitive information such as configuration files, credentials, or other private data. The vulnerability does not impact integrity or availability but poses a significant confidentiality risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the UiCore Elements plugin if possible, or restrict access to the WordPress installation to trusted users only. Monitor vendor channels for updates and apply patches promptly once available.