CVE-2024-5153

The vulnerability present in the Startklar Elementor Addons plugin for WordPress is characterized by a directory traversal flaw, which allows unauthorized access to the file system of the web server. This vulnerability arises from improper validation of the 'dropzone_hash' parameter, enabling attackers to manipulate file paths. By exploiting this weakness, an attacker can traverse directories and access sensitive files that should remain protected. This can include configuration files, user data, and other critical resources that could compromise the integrity and confidentiality of the web application and its users.

Attack vectors for this vulnerability are particularly concerning due to the ease with which they can be executed. An attacker does not require authentication to exploit this flaw, which significantly lowers the barrier to entry. By crafting a malicious request that includes specially crafted parameters, an attacker can gain access to arbitrary files on the server. For instance, they could retrieve sensitive configuration files such as wp-config.php, which contains database credentials and other critical information. Additionally, the ability to delete arbitrary directories poses a severe threat, as it could lead to the complete compromise of the WordPress installation, resulting in service disruption and data loss.

The real-world impact of this vulnerability is profound, particularly for businesses that rely on WordPress for their online presence. The potential for data breaches is significant, as unauthorized access to sensitive information can lead to identity theft, financial fraud, and reputational damage. Furthermore, the ability to delete directories could result in the loss of critical business operations, leading to downtime and financial losses. Organizations may also face compliance issues if sensitive data is exposed, resulting in legal ramifications and penalties. The high CVSS score of 9.8 reflects the critical nature of this vulnerability and the urgent need for remediation.

To detect and mitigate this vulnerability, organizations should implement a multi-faceted approach. Regular security assessments and vulnerability scans can help identify instances of the affected plugin in use. Additionally, monitoring server logs for unusual access patterns can provide early warning signs of exploitation attempts. Organizations should also ensure that they are using the latest version of the plugin, as updates often include patches for known vulnerabilities. Furthermore, employing web application firewalls (WAF) can help filter out malicious requests and provide an additional layer of security against exploitation attempts.

In conclusion, the directory traversal vulnerability in the Startklar Elementor Addons plugin poses a significant threat to WordPress installations. The ease of exploitation combined with the potential for severe consequences necessitates immediate action from affected organizations. By adopting proactive detection and mitigation strategies, businesses can safeguard their web applications against this and similar vulnerabilities, ultimately protecting their data and maintaining trust with their users.

The CVSS score adjustment from 9.8 to 9.1 reflects a refined understanding of the vulnerability’s exploitability and impact, informed by ongoing analysis and telemetry. While the critical severity remains, this recalibration indicates a slightly moderated risk profile, likely due to mitigations in exploit complexity or the presence of partial environmental constraints limiting widespread exploitation. CSURFACE threat intelligence notes that the exploit probability, as measured by the Exploit Prediction Scoring System (EPSS), remains stable at a high percentile, underscoring persistent threat relevance. Importantly, the emergence of a secure fork on GitHub that patches CVE-2024-5153 and related file upload vulnerabilities signals active community response but also highlights the continued need for vigilance, as unauthenticated attackers retain the capability to perform directory traversal attacks with potentially severe consequences. For defenders, this update emphasizes that although the immediate risk is marginally recalibrated, the vulnerability continues to represent a critical attack vector requiring ongoing monitoring, especially given the stable exploit likelihood and the availability of proof-of-concept code that could facilitate exploitation in unpatched environments.

Update 2 — May 21, 2026

The CVSS score for CVE-2024-5153 has been revised upward from 9.1 to 9.8, reflecting a reassessment of the vulnerability’s criticality based on its potential impact and exploitability. This adjustment underscores the heightened severity of the directory traversal flaw in the Startklar Elementor Addons plugin, which allows unauthenticated attackers to access and manipulate sensitive server files, including the deletion of critical directories. CSURFACE threat intelligence confirms that while exploit activity remains stable without a marked surge, the presence of publicly available proof-of-concept code continues to lower the barrier for adversaries to weaponize this vulnerability. Consequently, this recalibration signals that defenders must maintain a heightened state of vigilance, as the risk of compromise remains acute. The increased CVSS score also aligns with the vulnerability’s potential to facilitate broader attack chains, including data exfiltration and site disruption, thereby elevating its priority within vulnerability management programs.