cve-2024-4346
CRITICAL CVSS 9.1 vulncheck_kev
Description
The Startklar Elementor Addons plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.7.13. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible.
Timeline
- Published
- 2026-05-04 00:00 UTC
- Last Modified
- 2026-05-04
CVSS Details
CVSS details not available.
Affected Products
No product information available.
References
No references available.
Linked Vulnerabilities
No linked vulnerabilities found.
{
"cvss": 9.1,
"datePublished": "2026-05-04T00:00:00Z",
"dateUpdated": "2026-05-04T00:00:00Z",
"description": "The Startklar Elementor Addons plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.7.13. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible.",
"dueDate": "",
"id": "CVE-2024-4346",
"kev_catalogs": [
"vulncheck"
],
"knownRansomwareCampaignUse": "Unknown",
"product": "startklar_elmentor_addons",
"requiredAction": "Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.",
"severity": "CRITICAL",
"source": "vulncheck_kev",
"title": "web-shop-host startklar_elmentor_addons Improper Limitation of a Pathname to a Restricted Directory",
"vendor": "web-shop-host"
}