CVE-2024-4346criticalobserved exploitationCWE-22

CVE-2024-4346: critical vulnerability in wshberlin Startklar Elementor Addons

Startklar Elementor Addons <= 1.7.13 - Unauthenticated Arbitrary File Deletion

Published · Updated

Follow this CVE+ Monitor Startklar Elementor Addons

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

50Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck.

ssvc Actcvss 9.1epss 1.5%
from disclosure to weapon
Published on NVDMay 7
VulnCheck+727d
The Startklar Elementor Addons plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.7.13. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Affected products
wshberlin · Startklar Elementor Addons
Related CVEs — wshberlin Startklar Elementor Addons

In the same product, most dangerous first.

CVE-2024-4345CRITICALStartklar Elementor Addons <= 1.7.13 - Unauthenticated Arbitrary File UploadEPSS 1.5%CVE-2024-5153CRITICALStartklar Elementor Addons <= 1.7.15 - Unauthenticated Path Traversal to Arbitrary Directory DeletionEPSS 1.0%