Piotnet Addons For Elementor
Monthly
Authenticated path traversal in the Piotnet Addons for Elementor WordPress plugin (versions up to and including 7.1.71) lets a Contributor-level account read and download arbitrary files from the host, exposing wp-config.php credentials, backups, and other sensitive data (CVSS 3.1: 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw is confidentiality-only - an attacker gains no ability to write, modify, or disrupt the site - and it requires a valid Contributor login, so exposure is concentrated on sites that allow open registration or hand Contributor roles to untrusted users. There is no CISA KEV entry and no public exploit code identified at time of analysis, and Patchstack is the reporting source through its WordPress vulnerability database.
Authenticated path traversal in the Piotnet Addons for Elementor WordPress plugin (versions up to and including 7.1.71) lets a Contributor-level account read and download arbitrary files from the host, exposing wp-config.php credentials, backups, and other sensitive data (CVSS 3.1: 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw is confidentiality-only - an attacker gains no ability to write, modify, or disrupt the site - and it requires a valid Contributor login, so exposure is concentrated on sites that allow open registration or hand Contributor roles to untrusted users. There is no CISA KEV entry and no public exploit code identified at time of analysis, and Patchstack is the reporting source through its WordPress vulnerability database.