CVE-2024-4346 CRITICAL

CVE-2024-4346: Startklar Elementor Addons <= 1.7.13 - Unauthenticated Arbitrary File Deletion

Vendor Wshberlin

Product Startklar Elementor Addons

Weakness CWE-22 · Path traversal

Published May 7, 2024

Last update April 8, 2026

View on NVD All CVEs

CVSS base score

9.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality None

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

What the vulnerability does

01Description

The Startklar Elementor Addons plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.7.13. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible.

Key dates

02Disclosure timeline

May 7, 2024 CVE published

April 8, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-4346 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/22.html

Related vulnerabilities

04Related CVE

CVE-2026-57966 Spice-vdagent: path traversal in file transfer via unsanitized filename CVE-2019-1818 Cisco Prime Infrastructure and Evolved Programmable Network Manager Path Traversal Vulnerability CVE-2026-46402 Microsoft UFO uses untrusted task_name in log paths, allowing authenticated path traversal and log file creation outside the logs directory CVE-2024-54380 WordPress WP Cookies Enabler plugin <= 1.0.1 - Local File Inclusion vulnerability CVE-2025-67684 Remote Code Execution via Local File Inclusion in Quick.Cart