CVE-2024-4346: Arbitrary File Access in Startklar Elementor Addons

The primary impact of CVE-2024-4346 is the ability for an attacker to delete arbitrary files on a WordPress server. Because the vulnerability requires no authentication, any user can exploit it. The most critical consequence is the potential deletion of the wp-config.php file, which contains sensitive database credentials and configuration settings. Deletion of this file effectively renders the WordPress site inoperable and allows an attacker to potentially gain full control over the database and server. Beyond wp-config.php, attackers could delete other critical files, disrupting site functionality or even gaining a foothold for further malicious activity, such as remote code execution if they can upload and execute malicious code after file deletion.

1. Reserved2024-04-30
2. Published2024-05-07
3. Modified2024-08-01
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-4346 is to upgrade the Startklar Elementor Addons plugin to a version that addresses the vulnerability. The vendor has not released a specific fixed version as of this writing, so monitor their website for updates. As a temporary workaround, restrict file upload permissions on the server to prevent attackers from uploading malicious files. Consider implementing a Web Application Firewall (WAF) with rules to block suspicious file deletion requests. Regularly back up your WordPress site, including the wp-config.php file, to facilitate restoration in case of a successful attack. After upgrading, verify the fix by attempting a file deletion request through the plugin’s interface to ensure it is properly restricted.