CVE-2024-5153

Deeper analysis

The Startklar Elementor Addons plugin for WordPress is affected by a directory traversal vulnerability (CWE-22) in all versions through 1.7.15. The flaw resides in the dropzone_form_field.php component and is triggered through the dropzone_hash parameter, allowing unauthorized reading of arbitrary file contents and deletion of arbitrary directories on the server, including the WordPress root. It carries a CVSS 3.1 score of 9.1 reflecting network-accessible attack complexity that is low with no privileges or user interaction required.

Unauthenticated remote attackers can exploit the issue to exfiltrate sensitive data from files anywhere on the filesystem and to remove directories at will, which may result in complete site destruction. The attack path is exposed directly through the plugin's form widget handling without any authentication gate.

Public references from Wordfence and the WordPress plugin tracker document the vulnerable code path but do not detail an available patch or specific mitigation steps beyond the standard practice of updating or disabling the plugin. The associated EPSS score remains flat at 0.0545 with no material increase since disclosure.