CVE-2024-9935

Deeper analysis

The PDF Generator Addon for Elementor Page Builder plugin for WordPress is vulnerable to path traversal in all versions through 2.0.0. The flaw exists in the rtw_pgaepb_dwnld_pdf() function and is tracked as CWE-22, enabling unauthenticated remote attackers to read arbitrary server files. It carries a CVSS 3.1 score of 7.5 with network attack vector, low complexity, and high confidentiality impact; CVE-2025-24569 is noted as a possible duplicate.

Unauthenticated attackers can supply crafted requests to the vulnerable function and retrieve the contents of sensitive files such as configuration files, credentials, or other data stored on the WordPress server. No authentication or user interaction is required, and successful exploitation yields direct file disclosure without affecting integrity or availability.

The referenced WordPress plugin changeset and Wordfence advisory indicate that a fix has been published; site owners should update the PDF Generator Addon for Elementor Page Builder to the newest version. The EPSS score stands at 0.9382, reflecting substantial exploitation likelihood.