CVE-2024-9935

The PDF Generator Addon for Elementor Page Builder plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.5 via the rtw_pgaepb_dwnld_pdf() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

7.49% chance of exploitation in the next 30 days, 94th percentile

Nuclei

high · CWE-22

Published

2024-11-16

Updated

2026-04-08

Proof-of-concept exploits (3)

• Nxploited/CVE-2024-99350★ · 2024-12-25
• RandomRobbieBF/CVE-2024-99352★ · 2024-11-18
• verylazytech/CVE-2024-99357★ · 2024-12-19

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9935.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2024-10914
• CVE-2024-21534
• CVE-2024-23692
• CVE-2024-23897
• CVE-2024-24919
• CVE-2024-4358