WordPress Plugin Path Traversal Enables Arbitrary File Read

The Hide My WP Lite plugin for WordPress is vulnerable to Arbitrary File Read in versions up to and including 1.3 via the he_wrapper_js and he_wrapper_css query parameters processed by the elementor_assets_filter() function. This is due to the function concatenating user-supplied input directly onto ABSPATH and passing the result to file_get_contents() without any path traversal validation, allow-list, realpath containment, or extension check; the result is then echoed in the HTTP response. Although the output is passed through wp_kses_post(), that function only filters HTML tags and does not prevent disclosure of arbitrary file contents. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the affected site's server (such as wp-config). Note: The exploit requires the Elementor plugin and the 'Hide Elementor' feature to be enabled.

Casky was already ahead

This CVE exploits attack patterns that Casky's 351matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Hide My WP Lite WordPress plugin contains a critical path traversal vulnerability (CWE-22) that allows unauthenticated attackers to read arbitrary files from affected servers. The vulnerability exists in the elementor_assets_filter() function, which processes the he_wrapper_js and he_wrapper_css query parameters without proper validation. By crafting requests with directory traversal sequences (e.g., ../ payloads), attackers can bypass intended path restrictions and use file_get_contents() to retrieve sensitive files such as wp-config.php containing database credentials, .env files with API keys, or system configuration files. With a CVSS score of 7.5, this affects any WordPress installation using Hide My WP Lite through version 1.3, potentially exposing credentials and configuration data that could lead to full site compromise.

Casky's 351 mapped security skills leverage Claude AI's extended reasoning to detect exploitation patterns associated with TA0001 (Reconnaissance) and TA0007 (Discovery) techniques. Practitioners would observe detection alerts for suspicious query parameter patterns containing path traversal indicators in HTTP logs—specifically requests targeting the elementor assets filter with encoded or unencoded ../ sequences. The platform identifies anomalous file_get_contents() calls attempting to read files outside expected directories, combined with unusual HTTP response patterns containing file contents being echoed back to clients. By correlating these indicators across the MITRE ATT&CK framework, Casky flags this as active reconnaissance and credential/sensitive data discovery activity, enabling security teams to respond before attackers establish persistence or exfiltrate critical configuration files.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

351 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-13347.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2026-13347

Casky has 351 skills that investigate the attack patterns behind CVE-2026-13347. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn