CVE-2025-8151: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in devitemsllc HT Mega Addons for Elementor – Elementor Widgets & Template Builder
The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.9.1 via the 'save_block_css' function. This makes it possible for authenticated attackers, with Author-level access and above, to create CSS files in any directory, and delete CSS files in any directory in a Windows environment.
AI Analysis
Technical Summary
The HT Mega Addons for Elementor plugin suffers from a CWE-22 path traversal vulnerability in the 'save_block_css' function, allowing authenticated users with Author-level privileges or above to write or delete CSS files outside the intended directory on Windows environments. This improper limitation of pathname enables manipulation of files in arbitrary locations, potentially affecting site integrity. The vulnerability affects all versions up to 2.9.1. No patch or official remediation guidance is currently available.
Potential Impact
Exploitation allows authenticated users with Author-level access or higher to create or delete CSS files in arbitrary directories on Windows hosts running the vulnerable plugin. This can lead to unauthorized modification of site files, potentially impacting site integrity. There is no impact on confidentiality or availability reported. No known exploits have been observed in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level access to trusted users only and monitor for suspicious file modifications related to CSS files on Windows servers hosting the plugin.
CVE-2025-8151: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in devitemsllc HT Mega Addons for Elementor – Elementor Widgets & Template Builder
Description
The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.9.1 via the 'save_block_css' function. This makes it possible for authenticated attackers, with Author-level access and above, to create CSS files in any directory, and delete CSS files in any directory in a Windows environment.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The HT Mega Addons for Elementor plugin suffers from a CWE-22 path traversal vulnerability in the 'save_block_css' function, allowing authenticated users with Author-level privileges or above to write or delete CSS files outside the intended directory on Windows environments. This improper limitation of pathname enables manipulation of files in arbitrary locations, potentially affecting site integrity. The vulnerability affects all versions up to 2.9.1. No patch or official remediation guidance is currently available.
Potential Impact
Exploitation allows authenticated users with Author-level access or higher to create or delete CSS files in arbitrary directories on Windows hosts running the vulnerable plugin. This can lead to unauthorized modification of site files, potentially impacting site integrity. There is no impact on confidentiality or availability reported. No known exploits have been observed in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level access to trusted users only and monitor for suspicious file modifications related to CSS files on Windows servers hosting the plugin.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-07-24T23:07:55.088Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 688b545fad5a09ad00b721b0
Added to database: 7/31/2025, 11:32:47 AM
Last enriched: 4/9/2026, 5:59:23 PM
Last updated: 5/9/2026, 4:21:01 AM
Views: 160
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.