CVE-2024-1974: HT Mega – Absolute Addons For Elementor <= 2.4.5 - Authenticated (Contributor+) Directory Traversal
The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.6 via the render function. This makes it possible for authenticated attackers, with contributor access or higher, to read the contents of arbitrary files on the server, which can contain sensitive information.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1974?
CVE-2024-1974 is a high severity vulnerability that allows authenticated attackers to exploit directory traversal in the HT Mega plugin.
How do I fix CVE-2024-1974?
To fix CVE-2024-1974, update the HT Mega – Absolute Addons For Elementor plugin to version 2.4.7 or higher.
Who is affected by CVE-2024-1974?
CVE-2024-1974 affects all versions of the HT Mega – Absolute Addons For Elementor plugin up to and including 2.4.6.
What can an attacker do with CVE-2024-1974?
An attacker with contributor access or higher can read arbitrary files on the server due to the directory traversal vulnerability in CVE-2024-1974.
When was CVE-2024-1974 disclosed?
CVE-2024-1974 was disclosed in early 2024, highlighting its impact on the security of WordPress installations using the vulnerable plugin.