CVE-2024-4346

The Startklar Elementor Addons plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.7.13. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible.

• CWE-22

• https://plugins.trac.wordpress.org/browser/startklar-elmentor-forms-extwidgets/trunk/startklarDropZoneUploadProcess.php?rev=3061298#L7
• https://plugins.trac.wordpress.org/changeset/3081987/startklar-elmentor-forms-extwidgets
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a125bbf1-8ff6-4f3d-a4fb-caaaefe1df2a?source=cve
• https://plugins.trac.wordpress.org/browser/startklar-elmentor-forms-extwidgets/trunk/startklarDropZoneUploadProcess.php?rev=3061298#L7
• https://plugins.trac.wordpress.org/changeset/3081987/startklar-elmentor-forms-extwidgets
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a125bbf1-8ff6-4f3d-a4fb-caaaefe1df2a?source=cve

Published

May 7, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-43454Windows Remote Desktop Licensing Service Remote Code Executi…7.1
• CVE-2024-43455Windows Remote Desktop Licensing Service Spoofing Vulnerabil…9.8
• CVE-2024-43456Windows Remote Desktop Services Tampering Vulnerability7.4
• CVE-2024-43457Windows Setup and Deployment Elevation of Privilege Vulnerab…7.8
• CVE-2024-43458Windows Networking Information Disclosure Vulnerability7.7
• CVE-2024-43459SQL Server Native Client Remote Code Execution Vulnerability8.8
• CVE-2024-43460Improper authorization in Dynamics 365 Business Central resu…8.8
• CVE-2024-43461Windows MSHTML Platform Spoofing Vulnerability8.8
• CVE-2024-43462SQL Server Native Client Remote Code Execution Vulnerability8.8
• CVE-2024-43463Microsoft Office Visio Remote Code Execution Vulnerability7.8
• CVE-2024-43464Microsoft SharePoint Server Remote Code Execution Vulnerabil…7.2
• CVE-2024-43465Microsoft Excel Elevation of Privilege Vulnerability7.8