CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
What the vulnerability does
The Startklar Elementor Addons plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.7.13. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible.
Explanation of Vulnerability in Simple Terms
Startklar Elementor Addons versions 1.7.13 and earlier contain a path traversal vulnerability that allows unauthenticated attackers to modify or delete files on the affected site. The vulnerability requires no user interaction and can be exploited over the network. An attacker can corrupt site files, delete critical data, or inject malicious content.
What an attacker can do
Modify or delete files on the site without authentication.
Potential impact on your site
Site files can be corrupted, deleted, or replaced with malicious content, potentially taking the site offline.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
