CVE-2026-13347: Hide My WP Lite Arbitrary File Read via Path Traversal

Technical summary

Hide My WP Lite versions ≤1.3 fail to sanitize the he_wrapper_js and he_wrapper_css query parameters in the elementor_assets_filter() function. The plugin concatenates these user-supplied inputs directly onto ABSPATH and passes the result to file_get_contents() without path traversal validation, allow-list enforcement, realpath() containment, or extension filtering. Although output is passed through wp_kses_post() for HTML tag stripping, this function does not prevent disclosure of file contents themselves. Unauthenticated attackers can exploit this to read arbitrary files accessible to the web server process, including wp-config.php and other sensitive system files. Exploitation requires Elementor plugin presence and the 'Hide Elementor' feature to be enabled on the target site.

Business impact

Successful exploitation exposes critical site secrets: database credentials from wp-config.php, authentication keys, API integrations, user data, and backend configuration details. Threat actors can chain this information leak with other vulnerabilities or social engineering to escalate attacks. For multi-site WordPress installations, a single compromised instance may reveal information affecting the entire network. Regulatory compliance (HIPAA, PCI-DSS, GDPR) may be violated if personal or financial data is inadvertently disclosed through accessible files. The reputational damage of credential exposure and potential secondary breaches creates both immediate and long-term business risk.

Affected systems

Hide My WP Lite plugin versions up to and including 1.3 are vulnerable. The vulnerability is actively exploitable only when both Elementor plugin and the 'Hide Elementor' feature are enabled on the WordPress installation. Any WordPress site matching these criteria—regardless of hosting provider, WordPress version, or other plugins—is at risk. Organizations running older versions of Hide My WP Lite should assume they are exposed.

Exploitability

Exploitability is high. The attack requires no authentication, no user interaction, and minimal complexity: an attacker simply crafts HTTP requests with path traversal sequences in the vulnerable parameters. The vector is network-accessible from the public internet. No special privileges, specialized tools, or insider knowledge are required. The only gatekeeping factor is the presence of Elementor and the 'Hide Elementor' setting, but these are common configurations. Public awareness of this vulnerability increases the likelihood of widespread exploitation; defenders should assume active scanning and attempted file reads are already occurring.

Remediation

Immediate action: Disable the Hide My WP Lite plugin or update to a patched version released by the vendor. Verify the current plugin version in your WordPress admin dashboard (Plugins menu). If you cannot patch immediately, deactivate both Hide My WP Lite and Elementor as a temporary measure, or restrict access to wp-admin and frontend by IP if your site supports it. After patching, audit server logs for suspicious file_get_contents() calls or unusual HTTP requests to the affected parameters to detect prior exploitation.

Patch guidance

Check the Hide My WP Lite plugin page in your WordPress dashboard or on wordpress.org/plugins/hide-my-wp-lite for the latest available version. The vendor should have released a patched version that sanitizes the he_wrapper_js and he_wrapper_css parameters with proper path containment (realpath comparison, allow-listing, or extension validation). Verify against the vendor's official security advisory or changelog before deploying. If no patched version is published, contact the plugin author or consider switching to an actively maintained alternative. Test patches in a staging environment first.

Detection guidance

Monitor HTTP access logs for requests containing 'he_wrapper_js' or 'he_wrapper_css' parameters with path traversal sequences (../, .., encoded variations). Look for requests attempting to read wp-config.php, .env, or other sensitive files. Web application firewalls (WAF) can block requests with ../ or encoded equivalents in these parameters. File integrity monitoring on wp-config.php and other sensitive files can alert to unauthorized access. Review WordPress activity logs and audit plugins for failed or suspicious Hide My WP Lite function calls. A spike in 404 errors or file_get_contents() warnings in PHP error logs may also signal active exploitation.

Why prioritize this

CVSS 7.5 (High) reflects unauthenticated network access to sensitive information with high confidentiality impact. Prioritize this vulnerability because: (1) exploitation is trivial and requires no special skills; (2) exposed credentials enable lateral movement and privilege escalation; (3) affected plugin is widely used in WordPress ecosystems; (4) the dependency on Elementor and a specific setting does not materially reduce risk—both are common; (5) no vendor patch status is currently tracked, suggesting widespread deployments remain unpatched. Organizations should treat this as critical if they run the vulnerable configuration.

Risk score, explained

The CVSS 3.1 score of 7.5 is driven by Network vector (AV:N), Low complexity (AC:L), No privileges required (PR:N), No user interaction (UI:N), and High confidentiality impact (C:H). Integrity and availability are not affected, hence the score does not reach Critical. However, real-world risk is compounded by the ease of exploitation, the commonality of WordPress and Elementor, the sensitivity of exposed data (credentials and configuration), and the likelihood of active exploitation. Security teams should treat this as a near-critical priority despite the numerical score.

Frequently asked questions