CVE-2024-4346

CVE-2024-4346 is a critical arbitrary file deletion vulnerability affecting all versions up to and including 1.7.13 of the Startklar Elementor Addons plugin for WordPress. This flaw, stemming from insufficient validation of uploaded file paths, allows unauthenticated attackers to delete arbitrary files, including sensitive ones like wp-config.php. With a CVSS score of 9.1 (CRITICAL), the vulnerability is easily exploitable over the network with low attack complexity, potentially leading to site takeover and remote code execution. While there is no known active exploitation, public exploit code, or significant community discussion at this time, its high EPSS score indicates a notable potential for future exploitation.