Piotnet Addons CVE-2026-39754

Requires an authenticated WordPress account at Contributor privilege level (PR:L) on a site running Piotnet Addons For Elementor version 7.1.71 or earlier; the vulnerable plugin's file-download functionality must be reachable. No user interaction is needed (UI:N) and the attack is remote over the network (AV:N). The key limiting factor is the Contributor authentication requirement - sites that do not permit untrusted user registration or self-service author accounts sharply reduce the realistic attacker pool. Impact is limited to reading/downloading files (confidentiality only); no write, modification, or denial-of-service capability is granted by this flaw.

This is a moderate-priority issue, not a top-tier emergency. The CVSS 3.1 base score of 6.5 (vector AV:N/AC:L/PR:L/UI:N) reflects network-reachable, low-complexity exploitation but requires authenticated access at Contributor level (PR:L), which materially constrains the attacker population to users who already hold a low-privilege account on the WordPress site. Impact is confined to confidentiality (C:H, I:N, A:N): an attacker can read/download arbitrary server-side files (e.g., wp-config.php with DB credentials and secret keys) but cannot directly modify or destroy data through this flaw alone. There is no EPSS score, no CISA KEV listing, and no public POC referenced in the provided data, so there is no evidence of active exploitation or at-scale weaponization - exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent (authenticated path traversal yielding file disclosure), so no contradiction needs flagging; however, EPSS is simply absent rather than low, so probability of exploitation cannot be quantified from the input. Net: treat as a meaningful information-disclosure risk on multi-author sites where Contributor accounts are open to registration, but lower priority on sites where all authenticated users are trusted.

An attacker registers or obtains a Contributor-level WordPress account on a site running Piotnet Addons For Elementor <= 7.1.71, then abuses the plugin's file-download handler with a path-traversal sequence to download sensitive server files such as wp-config.php. No public exploit code is referenced, and user interaction is not required (UI:N). Harvested database credentials or secret keys can then be used to escalate toward fuller compromise.