S4E just found a medium ssl lucky13 vulnerability scanner
high·Product Based Web Vulnerabilities·Updated Dec 3, 2024

CVE-2024-9935 Scanner

CVE-2024-9935 Scanner - Arbitrary File Download vulnerability in PDF Generator Addon for Elementor Page Builder

Est. Time~10 seconds
Scan TypeSingle Scan
Targetsdomain, ipv4, subdomain
CostFree
2.1k
Times Used
continuous scan runs
3.4k
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
CVECVE-2024-9935
7.5
CVSShigh
Exploitable remotely over the internet · no authentication required.

The PDF Generator Addon for Elementor Page Builder plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.0.0 via the rtw_pgaepb_dwnld_pdf() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. CVE-2025-24569 may be a duplicate of this issue.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
Affected
PDF Generator for WordPress Elementorby redefiningtheweb
0
pdf_generator_addon_for_elementor_page_builderby redefiningtheweb
0
Updated Aug 22, 2026View on NVD →
Detail

The PDF Generator Addon for Elementor Page Builder is a plugin widely used in WordPress environments for generating PDFs directly from web content. It is particularly popular among website developers and content creators who need automated PDF generation for their sites. This plugin integrates seamlessly with Elementor Page Builder, enhancing its functionality and efficiency in creating downloadable content.

The vulnerability detected allows an attacker to exploit path traversal within the plugin's rtw_pgaepb_dwnld_pdf() function. By manipulating the parameters of this function, attackers can access files outside the intended directories, exposing sensitive data. It is a significant security risk because unauthorized file access can lead to further exploitation of the system.

Technical details of the vulnerability involve the improper handling of input sanitization in the file download functionality. Attackers can inject directory traversal sequences like `../../../` to traverse file paths and access restricted files. The vulnerable endpoint is triggered using a crafted HTTP request that manipulates the "rtw_pdf_file" parameter.

Exploitation of this vulnerability can lead to unauthorized access to sensitive server files, including configuration files, database credentials, and other critical information. It compromises the server's integrity and may lead to further attacks or unauthorized access to user data.

REFERENCES

Solution Advice
  • Update the plugin to a patched version if available or contact the vendor for updates.
  • Disable the plugin temporarily if updates are not available to mitigate risks.
  • Restrict access to sensitive files through server configurations.
  • Implement input validation to sanitize parameters in file-handling functions.
  • Conduct a security audit of the WordPress installation for other potential vulnerabilities.

Get AI-powered remediation steps tailored to your asset.

Try AI Solutions →
Similar Tools
low
CVE-2023-2252 Scanner
→high
CVE-2021-41291 Scanner
→medium
CVE-2024-7928 Scanner
→medium
CVE-2024-6095 Scanner
→critical
CVE-2022-47615 Scanner
→critical
CVE-2024-3136 Scanner
→critical
CVE-2023-1177 Scanner
→high
CVE-2023-2356 Scanner
→

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

CVE-2024-9935 Scanner - Arbitrary File Download vulnerability in PDF Generator Addon for Elementor Page Builder S4E