Exploitation Research Plan: CVE-2025-13997 - King Addons for Elementor Unauthenticated API Key Disclosure

1. Vulnerability Summary

The King Addons for Elementor plugin (up to version 51.1.49) contains an information disclosure vulnerability where sensitive API keys and secrets (Mailchimp, Facebook, Google) are leaked to the public HTML source code. This occurs because the plugin's render_full_form function (likely associated with form-based widgets like Mailchimp or Social Login) outputs these configuration values directly into the frontend markup without checking the visitor's authentication or authorization level. This vulnerability specifically affects sites where the Premium license features are active.

2. Attack Vector Analysis

• Endpoint: Any public-facing WordPress page or post where a vulnerable King Addons widget (e.g., Mailchimp, Login, or Social Login) is rendered.
• Vulnerable Function: render_full_form (inferred to be within a Pro/Premium widget class or form helper).
• Authentication: None (Unauthenticated).
• Preconditions:
  1. The Premium version of the plugin must be active.
  2. API keys (Mailchimp, Facebook, or Google) must be configured in the plugin settings.
  3. A widget utilizing the render_full_form function must be placed on a public page.

3. Code Flow

1. Initialization: The plugin loads widgets and extensions via King_Addons\Core::instance().
2. Request: An unauthenticated visitor requests a page containing an Elementor widget from King Addons.
3. Rendering: Elementor calls the render() method of the widget.
4. Vulnerable Call: The widget's render() method invokes render_full_form().
5. Information Retrieval: Inside render_full_form(), the code retrieves the plugin's global options:
   • $options = get_option('king_addons_options', []);
6. Disclosure: The function constructs HTML (e.g., hidden inputs or JS config objects) containing keys like mailchimp_api_key, facebook_app_secret, or google_client_secret and echoes them directly to the page buffer.

4. Nonce Acquisition Strategy

This vulnerability does not require a WordPress nonce because it is a passive information disclosure via a GET request to a public page. The disclosure happens during the standard rendering of the page content.

5. Exploitation Strategy

Step 1: Preparation (Simulate Premium and Configure Keys)

The vulnerability requires "Premium" features. We will mock the premium state and populate the king_addons_options with dummy secrets.

Step 2: Identify and Place Vulnerable Widget

The vulnerability description identifies render_full_form as the sink. We will search for this function in the plugin directory to identify the specific widget. Based on the leaked keys (Mailchimp/Facebook), the "Mailchimp" or "Social Login" widgets are the primary suspects.

Step 3: Trigger Disclosure

1. Create a public page.
2. Add the identified widget to the page.
3. Perform an unauthenticated GET request to the page.
4. Parse the HTML to find the secrets.

6. Test Data Setup

1. Inject Dummy API Keys:

   wp option update king_addons_options '{"mailchimp_api_key":"MOCK_MAILCHIMP_KEY_12345","facebook_app_secret":"MOCK_FB_SECRET_67890","google_client_secret":"MOCK_GOOGLE_SECRET_ABCDE"}' --format=json
   

2. Find the Widget:
   Search for the vulnerable function:

   grep -r "render_full_form" /var/www/html/wp-content/plugins/king-addons/
   

3. Create a Target Page:
   Assuming the widget uses a shortcode or can be identified by its PHP class (e.g., Mailchimp), create a page. Since we are in a PoC environment, we will use a shortcode if available, or manually trigger the widget's render.
   • Note: If the specific widget shortcode is unknown, we will look for add_shortcode in the plugin source or use a generic Elementor library template.

7. Expected Results

A successful exploit will return the HTML content of the page where the dummy keys are visible in the source.

Example Expected HTML Snippet:

<div class="king-addons-form-wrapper">
    <input type="hidden" name="mailchimp_api" value="MOCK_MAILCHIMP_KEY_12345">
    <!-- OR -->
    <script>
        var ka_form_config = {"mailchimp_key":"MOCK_MAILCHIMP_KEY_12345", ...};
    </script>
</div>

8. Verification Steps

1. HTTP Request (Unauthenticated):

   # Use the http_request tool to fetch the public page
   # Look for the "MOCK_MAILCHIMP_KEY_12345" string in the response body.
   

2. Manual Source Check:
   Navigate to the page using browser_navigate and use browser_eval("document.body.innerHTML") to search for the secrets.

9. Alternative Approaches

If a specific widget cannot be easily placed on a page via CLI:

1. Direct Function Call: If is_admin() is not checked inside render_full_form, we can use wp eval to call the function and confirm it outputs the keys, though the CVSS requires unauthenticated web access.
2. Shortcode Bruteforce: King Addons typically uses widget slugs as shortcodes. Try [king_mailchimp], [king_addons_mailchimp], or check the ModulesMap.php for php-class names to infer the widget's identity.
3. Template Injection: If the plugin allows importing templates (common in Addon packs), import a template that uses the vulnerable widget.