Element Pack Addons for Elementor <= 8.3.17 - Authenticated (Contributor+) Arbitrary File Read

This research plan outlines the steps required to verify and exploit CVE-2026-1793, an Arbitrary File Read vulnerability in the Element Pack Addons for Elementor plugin.

1. Vulnerability Summary

The "Element Pack Addons for Elementor" plugin (specifically the SVG widget) is vulnerable to arbitrary file reading. This occurs because the render_svg function (inferred to be within the SVG widget class) accepts a file path as input without adequate sanitization or restriction to the intended directory. An attacker with Contributor+ privileges can use path traversal sequences (../../) to read sensitive files on the server, such as wp-config.php.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• Action: elementor_ajax (standard Elementor widget rendering flow)
• Vulnerable Widget: SVG Widget (slug: bdt-svg or bdthemes-svg - inferred)
• Vulnerable Parameter: Likely a widget control parameter such as svg_path, manual_path, or source_path (inferred).
• Authentication: Authenticated (Contributor-level or higher).
• Preconditions: The Element Pack plugin must be active, and the attacker must have permission to edit a post using Elementor.

3. Code Flow (Inferred)

1. A Contributor user opens the Elementor editor for a post.
2. The user adds or modifies an SVG Widget.
3. The user sets the SVG source to "Custom Path" or "Upload" (if the widget allows direct path input).
4. The Elementor editor sends an AJAX request to admin-ajax.php with the action elementor_ajax and data payload to render_widget.
5. The plugin's render_svg function is called to process the SVG.
6. The function takes the path provided in the widget controls.
7. Sink: The function likely calls file_get_contents(), include(), or readfile() on the user-provided path without traversal checks.
8. The contents of the file are returned in the AJAX response (JSON) or rendered directly into the page source.

4. Nonce Acquisition Strategy

Elementor requires specific nonces for its AJAX operations.

1. Create Post: Use WP-CLI to create a draft post.

   wp post create --post_type=post --post_status=draft --post_title="Exploit Test" --post_author=CONTRIBUTOR_ID
   

2. Access Editor: Login as the Contributor and navigate to the Elementor editor for that post: /wp-admin/post.php?post=POST_ID&action=elementor.
3. Extract Nonce: Use browser_eval to extract the necessary nonces from the Elementor configuration object.
   • Common Nonce: browser_eval("window.elementorCommon?.config?.ajax?.nonce")
   • Editor Nonce: browser_eval("window.elementorConfig?.editor_post?.nonce")
4. Identify Widget Internal Name: While in the editor, search the DOM or window.elementor.widgets for the SVG widget's exact slug.

5. Exploitation Strategy

Step 1: Discover Vulnerable Control Name

Since the exact parameter name isn't in the CVE description, find it by adding an SVG widget in the browser and inspecting the control values.

• Look for a control that allows "Custom SVG" or "Local Path".
• Common control keys for this plugin: svg_source, manual_path, svg_path.

Step 2: Craft the Payload

The payload will be an AJAX request to the elementor_ajax endpoint.

HTTP Request:

• URL: http://TARGET/wp-admin/admin-ajax.php
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Body:

  action=elementor_ajax&
  _nonce=[ELEMENTOR_COMMON_NONCE]&
  actions={"render_widget":{"action":"render_widget","data":{"editor_post_id":[POST_ID],"widget_id":"[WIDGET_INSTANCE_ID]","model":{"id":"[WIDGET_INSTANCE_ID]","elType":"widget","widgetType":"bdthemes-svg","settings":{"[VULNERABLE_CONTROL]":"../../../../wp-config.php"}}}}}
  

  (Note: bdthemes-svg is a likely widgetType name for this plugin)

Step 3: Execute via http_request

Send the request with valid Contributor cookies. The response should contain the content of wp-config.php inside the data.render_widget.data.content JSON field.

6. Test Data Setup

1. Plugin: Install bdthemes-element-pack-lite version 8.3.17.
2. User: Create a user with the contributor role.
3. Post: Create a post and enable Elementor for it.
4. Target File: Ensure a known file exists for testing (e.g., /etc/passwd or the site's wp-config.php).

7. Expected Results

• The AJAX response status code is 200 OK.
• The JSON response body contains a success: true flag.
• The data.render_widget.data.content (or similar) string contains sensitive strings from the targeted file, such as DB_NAME, DB_USER, DB_PASSWORD (if wp-config.php was targeted).

8. Verification Steps

1. Check Output: Verify the strings returned in the HTTP response match the known contents of the file on the server.
2. Path Confirmation: Verify that using a non-existent path returns an error or empty content.
3. Auth Check: Attempt the same request without Contributor cookies to confirm it requires authentication.

9. Alternative Approaches

• Direct Widget Render: If the widget renders on the frontend, identify the shortcode or post meta used to store widget settings and attempt to modify the post meta directly using other vulnerabilities, then view the post.
• Dynamic Discovery: Use grep -r "render_svg" . within the plugin directory to find the exact file and the control names used in $this->get_settings_for_display().
• Local File Inclusion (LFI): Check if the file is being included. If so, try to achieve Remote Code Execution (RCE) by including a log file or uploaded image containing PHP code.