The HT Mega Addons for Elementor plugin suffers from an improper limitation of a pathname to a restricted directory (CWE-22) vulnerability, allowing authenticated users with contributor or higher privileges to perform directory traversal attacks through the render function. This enables reading arbitrary files on the server, which may contain sensitive data. The vulnerability affects all versions up to 2.4.6 and has a CVSS 3.1 score of 8.8, reflecting a high-severity risk with network attack vector, low attack complexity, and no user interaction required. No patch or official fix has been disclosed yet.

Successful exploitation allows an authenticated attacker with contributor or higher privileges to read arbitrary files on the server hosting the WordPress site. This can lead to disclosure of sensitive information, potentially compromising confidentiality, integrity, and availability of the affected system. The high CVSS score reflects the significant impact on the system if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access and higher to trusted users only. Monitor for updates from the vendor and apply patches promptly once released.