CVE-2024-4346: 
WordPress vulnerability analysis and mitigation

The Startklar Elementor Addons plugin for WordPress contains an arbitrary file deletion vulnerability (CVE-2024-4346) affecting all versions up to and including 1.7.13. The vulnerability was discovered and reported by Wordfence, with disclosure on May 7, 2024 (Wordfence Advisory).

The vulnerability stems from improper path validation of uploaded files before deletion. The plugin fails to properly validate the path of an uploaded file prior to deleting it, which creates a security weakness. The vulnerability has been assigned a CVSS v3.1 base score of 9.1 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H (Wordfence Advisory).

This vulnerability allows unauthenticated attackers to delete arbitrary files from the affected WordPress installation, including critical files such as wp-config.php. The deletion of such critical files can lead to site takeover and potentially enable remote code execution (Wordfence Advisory).

The vulnerability can be exploited by unauthenticated attackers, requiring no special privileges or user interaction. The attack complexity is considered low, making it relatively straightforward to exploit (Wordfence Advisory).

Users should immediately update their Startklar Elementor Addons plugin to a version newer than 1.7.13. The vulnerability has been patched in subsequent versions (WordPress Plugin Repository).