CVE-2024-9935: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in redefiningtheweb PDF Generator for WordPress Elementor
The PDF Generator Addon for Elementor Page Builder plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.0.0 via the rtw_pgaepb_dwnld_pdf() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. CVE-2025-24569 may be a duplicate of this issue.
AI Analysis
Technical Summary
The PDF Generator Addon for Elementor Page Builder plugin for WordPress contains a path traversal vulnerability (CWE-22) in the rtw_pgaepb_dwnld_pdf() function. This flaw permits unauthenticated attackers to bypass directory restrictions and read arbitrary files on the server. The issue affects all plugin versions up to and including 2.0.0. The vulnerability is tracked as CVE-2024-9935 with a CVSS 3.1 base score of 7.5, indicating high severity. No patch or official fix has been documented in the provided data. CVE-2025-24569 may be a duplicate of this issue.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to read arbitrary files on the server hosting the vulnerable WordPress plugin. This can result in disclosure of sensitive information stored on the server. There is no indication of impact on integrity or availability. No known active exploitation has been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and consider disabling the PDF Generator Addon if feasible to reduce exposure. Monitor vendor channels for updates.
CVE-2024-9935: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in redefiningtheweb PDF Generator for WordPress Elementor
Description
The PDF Generator Addon for Elementor Page Builder plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.0.0 via the rtw_pgaepb_dwnld_pdf() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. CVE-2025-24569 may be a duplicate of this issue.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The PDF Generator Addon for Elementor Page Builder plugin for WordPress contains a path traversal vulnerability (CWE-22) in the rtw_pgaepb_dwnld_pdf() function. This flaw permits unauthenticated attackers to bypass directory restrictions and read arbitrary files on the server. The issue affects all plugin versions up to and including 2.0.0. The vulnerability is tracked as CVE-2024-9935 with a CVSS 3.1 base score of 7.5, indicating high severity. No patch or official fix has been documented in the provided data. CVE-2025-24569 may be a duplicate of this issue.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to read arbitrary files on the server hosting the vulnerable WordPress plugin. This can result in disclosure of sensitive information stored on the server. There is no indication of impact on integrity or availability. No known active exploitation has been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and consider disabling the PDF Generator Addon if feasible to reduce exposure. Monitor vendor channels for updates.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2024-10-14T13:28:12.183Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 699f6b65b7ef31ef0b554f55
Added to database: 2/25/2026, 9:36:37 PM
Last enriched: 4/9/2026, 3:39:21 PM
Last updated: 4/12/2026, 5:32:08 PM
Views: 21
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.