Description

Contributor Arbitrary File Download in Piotnet Addons For Elementor <= 7.1.71 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-10-06T09:17:47.087Z",
  "pubdate": "2026-10-06T09:17:47.087Z",
  "executiveSummary": "A critical vulnerability exists in Piotnet Addons For Elementor versions <= 7.1.71, manifesting as an Arbitrary File Download (AFD) flaw.\nThis vulnerability allows an authenticated attacker with contributor-level privileges or higher to access sensitive files on the underlying server.\nThe flaw stems from insufficient input validation and improper handling of user-supplied paths within the plugin's file processing functionality.\nAn attacker can exploit this by crafting malicious requests to traverse the directory structure and retrieve arbitrary files, including configuration files containing database credentials, API keys, or sensitive system files.\nThe risk implication is high, as it can lead to full site compromise, remote code execution (via database takeover), or unauthorized access to personally identifiable information (PII).\nExploitation requires a valid contributor-level account on the target WordPress installation but does not require additional administrative privileges.",
  "technicalDetails": "The vulnerability is located within the file handling mechanisms of Piotnet Addons For Elementor, specifically where the plugin processes requests to retrieve or export files based on user-provided parameters.\nThe root cause is an improper neutralization of special elements used in a file path (CWE-22: Improper Limitation of a Pathname to a Restricted Directory, often referred to as Path Traversal). The plugin fails to adequately sanitize the input parameters before using them in file system operations.\nBecause the plugin does not properly validate or restrict these parameters to intended directories, an attacker can use dot-dot-slash (../) sequences to escape the web root or traverse outside the plugin's legitimate scope.\nExploitation occurs when an authenticated user, holding at least contributor-level privileges, sends a crafted HTTP request to the vulnerable endpoint. By manipulating the path parameter within this request, the attacker can force the application to read files that the web server process has read access to.\nThe attack flow follows these steps: 1) The attacker authenticates as a contributor. 2) The attacker intercepts or crafts a request intended for the file download functionality. 3) The attacker modifies the path/file parameter to include directory traversal sequences (e.g., ../../../wp-config.php). 4) The application processes the path without verifying if the requested file resides within the permitted directory tree. 5) The server returns the contents of the requested file directly to the attacker.\nThe impact of this vulnerability is severe. Upon successful exploitation, an attacker can read critical configuration files such as wp-config.php. This file typically contains database credentials, salts, and security keys, which can be leveraged to gain administrative access to the WordPress database. Furthermore, access to server-side code or system files can expose sensitive environment variables, SSH keys, or other credentials, facilitating broader system compromise."
}