CVE-2026-39754: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in About Piotnet Piotnet Addons For Elementor

This vulnerability (CVE-2026-39754) in Piotnet Addons For Elementor (<=7.1.71) is classified as CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). It allows a contributor-level user to perform arbitrary file downloads by exploiting insufficient validation of file path inputs. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low complexity, required privileges at contributor level, no user interaction, unchanged scope, high confidentiality impact, no integrity or availability impact.

An attacker with contributor-level privileges can exploit this vulnerability to download arbitrary files from the server, potentially exposing sensitive information. The confidentiality of the system is impacted, but integrity and availability are not affected. This could lead to information disclosure risks depending on the files accessible.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level user permissions and monitor for suspicious file access attempts related to this vulnerability.