CVE-2024-9935 Overview
CVE-2024-9935 is a path traversal vulnerability in the PDF Generator Addon for Elementor Page Builder plugin for WordPress. The flaw affects all versions up to and including 2.0.0 and resides in the rtw_pgaepb_dwnld_pdf() function. Unauthenticated attackers can supply manipulated path input to read the contents of arbitrary files on the underlying server. Disclosed files may include WordPress configuration data, credentials, and other sensitive material. The issue is tracked as [CWE-22] Improper Limitation of a Pathname to a Restricted Directory. CVE-2025-24569 may be a duplicate of this issue.
Critical Impact
Unauthenticated remote attackers can read arbitrary files from the WordPress server, exposing wp-config.php secrets, database credentials, and other sensitive site data.
Affected Products
- PDF Generator Addon for Elementor Page Builder plugin for WordPress
- All versions up to and including 2.0.0
- WordPress sites with the vulnerable plugin activated
Discovery Timeline
- 2024-11-16 - CVE-2024-9935 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-9935
Vulnerability Analysis
The vulnerability exists in the public-facing PDF download handler rtw_pgaepb_dwnld_pdf() exposed by the PDF Generator Addon for Elementor Page Builder. The handler accepts user-controlled input that influences a file path used during PDF generation or download. The plugin does not validate or canonicalize this input before reading the targeted file from disk.
An attacker can supply traversal sequences such as ../ within the request to escape the intended directory. The server then returns the contents of files outside the plugin's working directory. Because the endpoint requires no authentication, exploitation is reachable directly over the network without user interaction.
The EPSS score of 7.486% (93.7 percentile) reflects active interest in WordPress plugin path traversal flaws. Review the Wordfence Vulnerability Report for additional context.
Root Cause
The root cause is missing input sanitization on a filename or path parameter consumed by rtw_pgaepb_dwnld_pdf(). The function passes attacker-controlled values to a file read operation without restricting the path to an allowlisted directory or stripping traversal characters. See the PDF Addon Source Code for the vulnerable handler location.
Attack Vector
Exploitation is performed over HTTP(S) by issuing a crafted request to the WordPress site that invokes the plugin's PDF download action. The attacker injects a relative path containing ../ sequences targeting files such as wp-config.php, /etc/passwd, or backup files. The server response contains the contents of the requested file. The patch is documented in the plugin changeset.
No verified public exploit code is included here. Refer to the linked Wordfence and WordPress trac references for technical details.
Detection Methods for CVE-2024-9935
Indicators of Compromise
- HTTP requests to the WordPress site containing parameters with ../, ..%2f, or URL-encoded traversal sequences targeting the PDF download action.
- Web server access logs showing repeated requests invoking rtw_pgaepb_dwnld_pdf with unusual filename parameters.
- Outbound responses containing contents of wp-config.php, .htaccess, or other sensitive files served via the plugin endpoint.
Detection Strategies
- Inspect WordPress and reverse proxy logs for admin-ajax.php or REST requests referencing the PDF Generator Addon action with path-like values.
- Deploy WAF rules that block path traversal patterns and known sensitive filenames in query strings and POST bodies.
- Compare installed plugin versions across WordPress fleets and flag any instance of pdf-generator-addon-for-elementor-page-builder at version 2.0.0 or earlier.
Monitoring Recommendations
- Alert on successful HTTP 200 responses where the response body matches signatures of WordPress configuration files (DB_PASSWORD, AUTH_KEY).
- Monitor file system access patterns on web servers for the PHP-FPM worker reading paths outside the plugin directory.
- Track unauthenticated request bursts targeting plugin endpoints from a single source IP or distributed scanners.
How to Mitigate CVE-2024-9935
Immediate Actions Required
- Update the PDF Generator Addon for Elementor Page Builder plugin to a version newer than 2.0.0 that includes the upstream fix.
- If an update is not immediately available, deactivate and remove the plugin until a patched release is installed.
- Rotate any secrets stored in wp-config.php, including database credentials and WordPress salts, if exposure is suspected.
Patch Information
The vendor published a fix referenced in the WordPress plugin changeset that updates the rtw_pgaepb_dwnld_pdf() handler. Administrators should apply the latest plugin release through the WordPress plugins dashboard and verify the installed version is greater than 2.0.0.
Workarounds
- Block requests containing traversal sequences (../, ..%2f, ..%5c) at the WAF or reverse proxy layer.
- Restrict access to the plugin's PDF download endpoint by IP allowlist until the patch is applied.
- Enforce least-privilege file system permissions so the PHP process cannot read sensitive system files such as /etc/passwd or backups outside the web root.
# Example ModSecurity rule to block path traversal on the PDF endpoint
SecRule REQUEST_URI "@contains rtw_pgaepb_dwnld_pdf" \
"chain,phase:2,deny,status:403,id:1009935,msg:'CVE-2024-9935 path traversal attempt'"
SecRule ARGS "@rx \.\./|%2e%2e%2f|%2e%2e/" "t:lowercase,t:urlDecodeUni"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
