CVE-2024-4346

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

The Startklar Elementor Addons plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.7.13. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
May 7, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-434608.8Improper authorization in Dynamics 365 Business Central resulted in a vulnerability that allows an authenticated attacker to elevate privileCVE-2024-434618.8Windows MSHTML Platform Spoofing VulnerabilityCVE-2024-434628.8SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-434637.8Microsoft Office Visio Remote Code Execution VulnerabilityCVE-2024-434647.2Microsoft SharePoint Server Remote Code Execution VulnerabilityCVE-2024-434657.8Microsoft Excel Elevation of Privilege VulnerabilityCVE-2024-434667.5Microsoft SharePoint Server Denial of Service VulnerabilityCVE-2024-434677.5Windows Remote Desktop Licensing Service Remote Code Execution VulnerabilityCVE-2024-434689.8Microsoft Configuration Manager Remote Code Execution VulnerabilityCVE-2024-434698.8Azure CycleCloud Remote Code Execution VulnerabilityCVE-2024-43477.2The WP Fastest Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.6 via the specificDCVE-2024-434707.3Azure Network Watcher VM Agent Elevation of Privilege Vulnerability
CVE-2024-4346: Critical severity, CVSS 9.1 | Vulnix