CVE-2025-0661 DethemeKit For Elementor <= 2.1.8 - Authenticated (Contributor+) Protected Post Disclosure

What is CVE-2025-0661?

CVE-2025-0661 is a medium-severity vulnerability in DethemeKit for Elementor, published on 13 Feb 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The DethemeKit For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.36 via the duplicate_post() function due to insufficient restrictions on which posts can be duplicated. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, draft, or scheduled posts that they should not have access to by duplicating the post.

Weakness: CWE-639

Which versions are affected by CVE-2025-0661?

It affects 1 product.

Products include Detheme Dethemekit for Elementor.

How do I fix CVE-2025-0661?

No fix has been published for CVE-2025-0661 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-0661 being exploited?

There is no known exploitation of CVE-2025-0661 in the wild and no public exploit code.

Other vulnerabilities in DethemeKit for Elementor

• CVE-2025-26772 WordPress DethemeKit For Elementor plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerability Medium 6.5
• CVE-2024-47632 WordPress DethemeKit For Elementor plugin <= 2.1.7 - Cross Site Scripting (XSS) vulnerability Medium 6.5
• CVE-2024-34575 WordPress DethemeKit For Elementor plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability Medium 6.5
• CVE-2024-32508 WordPress DethemeKit For Elementor plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerability Medium 6.5
• CVE-2025-1526 DethemeKit for Elementor <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium 6.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wx3f-pjjp-293h.