CVE-2026-13347 is a path traversal vulnerability (CWE-22) in the Hide My WP Lite WordPress plugin (up to version 1.3). The elementor_assets_filter() function processes user-supplied he_wrapper_js and he_wrapper_css query parameters by concatenating them directly onto the ABSPATH constant and passing the result to file_get_contents() without any path traversal validation, allow-listing, realpath containment checks, or extension restrictions. Although the output is filtered through wp_kses_post(), this only sanitizes HTML tags and does not prevent disclosure of arbitrary file contents. This allows unauthenticated attackers to read arbitrary files on the server, including sensitive configuration files. The exploit requires the Elementor plugin and the 'Hide Elementor' feature to be enabled.

An unauthenticated attacker can read arbitrary files on the affected server, potentially exposing sensitive information such as database credentials stored in wp-config.php. This confidentiality breach does not affect integrity or availability directly but can facilitate further attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, disable the 'Hide Elementor' feature or the Hide My WP Lite plugin if possible. Restrict access to the affected endpoints and monitor for suspicious requests targeting the he_wrapper_js and he_wrapper_css parameters. Avoid exposing the Elementor plugin and Hide My WP Lite plugin to untrusted users.