Description
WordPress Elementor Page Builder 插件 / 存在任意文件读取漏洞，攻击者可构造恶意请求读取系统敏感文件。通过响应内容可见已成功读取数据库配置文件，泄露了数据库类型、地址、库名、账号密码等核心信息。
WordPress Elementor Page Builder 插件 / 文件读取漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/WordPress/WordPress%E6%8F%92%E4%BB%B6ElementorPageBuilder%E5%AD%98%E5%9C%A8%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E(CVE-2024-9935).md
https://cve.imfht.com/detail/CVE-2024-9935
https://www.ddpoc.com/DVB-2024-8554.html
https://cn-sec.com/archives/3561156.html
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/elementor/elementor-3302-authenticated-administrator-arbitrary-file-read-via-image-import
https://nvd.nist.gov/vuln/detail/CVE-2025-8081
https://wpscan.com/vulnerability/87fd0b78-c0e8-43a8-8b52-bd7a294a96e0/