Critical severity9.1NVD Advisory· Published Jun 6, 2024· Updated Apr 8, 2026

CVE-2024-5153

Description

The Startklar Elementor Addons plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.7.15 via the 'dropzone_hash' parameter. This makes it possible for unauthenticated attackers to copy the contents of arbitrary files on the server, which can contain sensitive information, and to delete arbitrary directories, including the root WordPress directory.

Affected products

Web Shop Host/Startklar Elmentor Addons
cpe:2.3:a:web-shop-host:startklar_elmentor_addons:*:*:*:*:*:wordpress:*:*
Range: <=1.7.15

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

plugins.trac.wordpress.org/browser/startklar-elmentor-forms-extwidgets/trunk/widgets/dropzone_form_field.phpnvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/baa20290-9c01-4f8d-adeb-fbfb15b9d6a9nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.591
epss	0.004
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000