The Document Pro Elementor – Documentation & Knowledge Base plugin for WordPress leaks sensitive Algolia API keys through its front‑end JavaScript code, bypassing any access restrictions. An attacker who can view the page source can capture these keys and use them to make unauthorized calls to the configured Algolia search service. This flaw allows unauthenticated disclosure of credentials that could facilitate further manipulation of the search index or data extraction.

All installations of the Document Pro Elementor – Documentation & Knowledge Base plugin with versions 1.0.9 or earlier are affected. The vulnerability exists in the WordPress plugin listing for ngothoai on Trac, and it is present in the code paths that enqueue scripts from the DPET_Enqueue.php file.

The CVSS score of 5.3 indicates medium severity, and the EPSS score of less than 1% suggests a low probability of exploitation at the time of analysis. The flaw is not currently listed in the CISA KEV catalog, but because the exposure is through public JavaScript, any user who visits a page that loads the plugin can retrieve the keys. Attackers do not need authenticated access, making the attack vector broad and straightforward—simply accessing a page that includes the plugin’s front‑end assets.