O plugin Startklar Elementor Addons para WordPress é vulnerável à exclusão arbitrária de arquivos em todas as versões até, e incluindo, 1.7.13. Isso ocorre devido à falta de validação adequada do caminho de

The primary impact of CVE-2024-4346 is the ability for an attacker to delete arbitrary files on a WordPress server. Because the vulnerability requires no authentication, any user can exploit it. The most critical consequence is the potential deletion of the wp-config.php file, which contains sensitive database credentials and configuration settings. Deletion of this file effectively renders the WordPress site inoperable and allows an attacker to potentially gain full control over the database and server. Beyond wp-config.php, attackers could delete other critical files, disrupting site functionality or even gaining a foothold for further malicious activity, such as remote code execution if they can upload and execute malicious code after file deletion.

WordPress sites using the Startklar Elementor Addons plugin, particularly those running versions 1.7.13 or earlier, are at risk. Shared hosting environments are especially vulnerable as they often have limited control over file permissions and server configurations. Sites with weak security practices or outdated WordPress installations are also at increased risk.

• wordpress / composer / npm:

grep -r "wp-config.php" /var/www/html/wp-content/plugins/startklar-elementor-addons/

• wordpress / composer / npm:

wp plugin list --status=active | grep startklar-elementor-addons

• wordpress / composer / npm:

curl -I https://your-wordpress-site.com/wp-content/plugins/startklar-elementor-addons/ | grep -i 'startklar elementor addons'

1. 2024-05-07Disclosure

   disclosure

1. Reservado2024-04-30
2. Publicada2024-05-07
3. Modificada2024-08-01
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2024-4346 is to upgrade the Startklar Elementor Addons plugin to a version that addresses the vulnerability. The vendor has not released a specific fixed version as of this writing, so monitor their website for updates. As a temporary workaround, restrict file upload permissions on the server to prevent attackers from uploading malicious files. Consider implementing a Web Application Firewall (WAF) with rules to block suspicious file deletion requests. Regularly back up your WordPress site, including the wp-config.php file, to facilitate restoration in case of a successful attack. After upgrading, verify the fix by attempting a file deletion request through the plugin’s interface to ensure it is properly restricted.