CVE-2024-1974: Path Traversal
First published: Tue Apr 09 2024(Updated: )
The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.6 via the render function. This makes it possible for authenticated attackers, with contributor access or higher, to read the contents of arbitrary files on the server, which can contain sensitive information.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WordPress HT Mega | <2.4.7 | |
| HT Mega - Absolute Addons for Elementor Page Builder | <=2.4.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/11b5f0a1-bf22-46be-a165-c62f1077da0f?source=cve
- https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/trunk/includes/widgets/htmega_weather.php#L401
- https://plugins.trac.wordpress.org/changeset/3048999/ht-mega-for-elementor/tags/2.4.7/includes/widgets/htmega_weather.php?old=2939273&old_path=ht-mega-for-elementor/trunk/includes/widgets/htmega_weather.php
Frequently Asked Questions
What is the severity of CVE-2024-1974?
CVE-2024-1974 is a high severity vulnerability that allows authenticated attackers to exploit directory traversal in the HT Mega plugin.
How do I fix CVE-2024-1974?
To fix CVE-2024-1974, update the HT Mega – Absolute Addons For Elementor plugin to version 2.4.7 or higher.
Who is affected by CVE-2024-1974?
CVE-2024-1974 affects all versions of the HT Mega – Absolute Addons For Elementor plugin up to and including 2.4.6.
What can an attacker do with CVE-2024-1974?
An attacker with contributor access or higher can read arbitrary files on the server due to the directory traversal vulnerability in CVE-2024-1974.
When was CVE-2024-1974 disclosed?
CVE-2024-1974 was disclosed in early 2024, highlighting its impact on the security of WordPress installations using the vulnerable plugin.
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/references
- agent/type
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/remedy
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/guess-ai
- vendor/hasthemes
- canonical/wordpress ht mega
- vendor/ht mega
- canonical/ht mega - absolute addons for elementor page builder