CVE-2024-5153

—

CVSS 3.1

9.8 critical

EPSS

1%p61

Published

Jun 6, 2024 (Jun 6, 2024)

Modified

Jun 17, 2026

Description

The Startklar Elementor Addons plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.7.15 via the 'dropzone_hash' parameter. This makes it possible for unauthenticated attackers to copy the contents of arbitrary files on the server, which can contain sensitive information, and to delete arbitrary directories, including the root WordPress directory.

Vendors: web-shop-host
Products: startklar elmentor addons
Ecosystems: WordPress
Weakness: CWE-22
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.0%)

In the news0 stories

No ingested article mentions this CVE yet.