CVE-2026-13347: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in templatic1 Hide My WP Lite
The Hide My WP Lite plugin for WordPress is vulnerable to Arbitrary File Read in versions up to and including 1.3 via the he_wrapper_js and he_wrapper_css query parameters processed by the elementor_assets_filter() function. This is due to the function concatenating user-supplied input directly onto ABSPATH and passing the result to file_get_contents() without any path traversal validation, allow-list, realpath containment, or extension check; the result is then echoed in the HTTP response. Although the output is passed through wp_kses_post(), that function only filters HTML tags and does not prevent disclosure of arbitrary file contents. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the affected site's server (such as wp-config). Note: The exploit requires the Elementor plugin and the 'Hide Elementor' feature to be enabled.
AI Analysis
Technical Summary
CVE-2026-13347 is a path traversal vulnerability (CWE-22) in the Hide My WP Lite WordPress plugin, specifically in the elementor_assets_filter() function. The plugin concatenates user-supplied input from he_wrapper_js and he_wrapper_css query parameters directly onto the ABSPATH constant and reads the file contents without validating the path or restricting file extensions. The contents are then output after passing through wp_kses_post(), which does not prevent arbitrary file disclosure. This allows unauthenticated attackers to read arbitrary files on the server, such as wp-config.php, if the Elementor plugin is installed and the 'Hide Elementor' feature is enabled.
Potential Impact
An unauthenticated attacker can read arbitrary files on the affected server, potentially exposing sensitive information such as database credentials stored in wp-config.php. This can lead to further compromise of the WordPress site or server. The vulnerability does not allow code execution or modification, but the confidentiality of server files is severely impacted.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, disabling the 'Hide Elementor' feature or uninstalling the Hide My WP Lite plugin can mitigate the risk. Additionally, restricting access to sensitive files at the web server level may reduce exposure. Monitor vendor channels for an official patch or update.
CVE-2026-13347: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in templatic1 Hide My WP Lite
Description
The Hide My WP Lite plugin for WordPress is vulnerable to Arbitrary File Read in versions up to and including 1.3 via the he_wrapper_js and he_wrapper_css query parameters processed by the elementor_assets_filter() function. This is due to the function concatenating user-supplied input directly onto ABSPATH and passing the result to file_get_contents() without any path traversal validation, allow-list, realpath containment, or extension check; the result is then echoed in the HTTP response. Although the output is passed through wp_kses_post(), that function only filters HTML tags and does not prevent disclosure of arbitrary file contents. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the affected site's server (such as wp-config). Note: The exploit requires the Elementor plugin and the 'Hide Elementor' feature to be enabled.
CVSS v3.1
Score 7.5high
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-13347 is a path traversal vulnerability (CWE-22) in the Hide My WP Lite WordPress plugin, specifically in the elementor_assets_filter() function. The plugin concatenates user-supplied input from he_wrapper_js and he_wrapper_css query parameters directly onto the ABSPATH constant and reads the file contents without validating the path or restricting file extensions. The contents are then output after passing through wp_kses_post(), which does not prevent arbitrary file disclosure. This allows unauthenticated attackers to read arbitrary files on the server, such as wp-config.php, if the Elementor plugin is installed and the 'Hide Elementor' feature is enabled.
Potential Impact
An unauthenticated attacker can read arbitrary files on the affected server, potentially exposing sensitive information such as database credentials stored in wp-config.php. This can lead to further compromise of the WordPress site or server. The vulnerability does not allow code execution or modification, but the confidentiality of server files is severely impacted.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, disabling the 'Hide Elementor' feature or uninstalling the Hide My WP Lite plugin can mitigate the risk. Additionally, restricting access to sensitive files at the web server level may reduce exposure. Monitor vendor channels for an official patch or update.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-06-25T14:32:04.252Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a50a3b368715ace433bd379
Added to database: 07/10/2026, 07:48:03 UTC
Last enriched: 07/10/2026, 07:54:14 UTC
Last updated: 07/10/2026, 21:45:49 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.