PT-2026-57102 · WordPress · Elementor+1
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Hide My WP Lite versions prior to 1.4
Description
An arbitrary file read issue exists when the
elementor assets filter() function processes the he wrapper js and he wrapper css query parameters. The function concatenates user-supplied input directly onto ABSPATH and passes it to file get contents() without path traversal validation, allow-list, realpath containment, or extension checks. Although the output is processed by wp kses post(), which filters HTML tags, it does not prevent the disclosure of arbitrary file contents. This allows unauthenticated attackers to read sensitive files on the server, such as wp-config. This issue requires the Elementor plugin to be installed and the 'Hide Elementor' feature to be enabled.Recommendations
Update Hide My WP Lite to a version later than 1.3.
As a temporary workaround, disable the 'Hide Elementor' feature to minimize the risk of exploitation.
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Elementor
Hide My Wp Lite