What is the CVSS score of CVE-2026-13347?

CVE-2026-13347 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Which versions of Hide My WP Lite are affected by CVE-2026-13347?

Hide My WP Lite WordPress plugin (versions ≤1.3) contains a vulnerability enabling unauthenticated attackers to steal database credentials and cryptographic keys, creating a direct pathway to…

How to fix or mitigate CVE-2026-13347?

Within 24 hours: Inventory all WordPress sites running Hide My WP Lite ≤v1.3 with Elementor; disable the plugin immediately. Within 7 days: Uninstall the vulnerable plugin entirely (no vendor patch available); evaluate alternative solutions for site protection requirements. Within 30 days: Rotate all WordPress database user passwords, regenerate security keys and salts in wp-config.php, review database access logs for unauthorized connections, and scan for attacker-created backdoors or persistent access.

Hide My WP Lite CVE-2026-13347

EUVD-2026-42831 HIGH

Path Traversal (CWE-22)

2026-07-10 Wordfence

GHSA-3335-cc43-jrmm

WordPress Path Traversal Wordpress Plugin Hide My Wp Lite

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 MEDIUM

Network-reachable unauthenticated read (AV:N/PR:N) but AC:H because a non-default Elementor + 'Hide Elementor' configuration is required; confidentiality-only impact (C:H, I/A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 08:29 vuln.today

CVE Published

Jul 10, 2026 - 06:51 nvd

HIGH 7.5

DescriptionCVE.org

The Hide My WP Lite plugin for WordPress is vulnerable to Arbitrary File Read in versions up to and including 1.3 via the he_wrapper_js and he_wrapper_css query parameters processed by the elementor_assets_filter() function. This is due to the function concatenating user-supplied input directly onto ABSPATH and passing the result to file_get_contents() without any path traversal validation, allow-list, realpath containment, or extension check; the result is then echoed in the HTTP response. Although the output is passed through wp_kses_post(), that function only filters HTML tags and does not prevent disclosure of arbitrary file contents. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the affected site's server (such as wp-config). Note: The exploit requires the Elementor plugin and the 'Hide Elementor' feature to be enabled.

AnalysisAI

Arbitrary file read in the Hide My WP Lite WordPress plugin (versions ≤ 1.3) lets unauthenticated attackers disclose any file readable by the web server - including wp-config.php with database credentials and secret keys - by abusing the he_wrapper_js and he_wrapper_css parameters handled by elementor_assets_filter(). Reported by Wordfence and rated CVSS 7.5, the flaw is confidentiality-only but exposes crypto salts and DB secrets that enable deeper compromise. There is no public exploit identified at time of analysis, and exploitation depends on the site also running Elementor with the plugin's 'Hide Elementor' feature enabled.

Technical ContextAI

The plugin is a WordPress security/obscurity add-on distributed under the 'hide-wp-login' slug (vendor 'templatic1'). The vulnerable elementor_assets_filter() function (see includes/functions.php around lines 117-139 in the 1.3 tag) takes the attacker-controlled he_wrapper_js/he_wrapper_css query values and concatenates them directly onto WordPress's ABSPATH constant, then passes the resulting path to PHP's file_get_contents() with no path-traversal validation, allow-list, realpath() containment check, or file-extension restriction. This is a textbook CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) issue: '../' sequences let the resolved path escape the WordPress root. The retrieved contents are echoed back after passing only through wp_kses_post(), which strips disallowed HTML but does nothing to prevent raw disclosure of source code or configuration files.

RemediationAI

No vendor-released patch identified at time of analysis - versions up to and including 1.3 are affected and no fixed version was provided in the source data, so administrators should monitor the plugin's WordPress.org page and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/e044c51c-40e0-4d33-8921-616d59e0e0d8?source=cve) for an update beyond 1.3 and apply it immediately when released. As an immediate compensating control, disable or deactivate the Hide My WP Lite plugin, since it provides obscurity rather than core functionality; if that is not acceptable, disable the plugin's 'Hide Elementor' feature, which removes the code path entirely (trade-off: loses that obfuscation feature). Where the plugin must stay active, add a WAF rule to block or sanitize requests containing '../' or absolute paths in the he_wrapper_js and he_wrapper_css query parameters, and rotate any secrets already exposed - regenerate the WordPress auth keys/salts in wp-config.php and change the database password - since a prior read may have already leaked them.