CVE-2025-8151: HT Mega Elementor Plugin Path Traversal

CVE-2025-8151 Overview

CVE-2025-8151 is a path traversal vulnerability [CWE-22] in the HT Mega – Absolute Addons For Elementor plugin for WordPress. The flaw resides in the save_block_css function within Manage_Styles.php and affects all versions up to and including 2.9.1. Authenticated attackers with Author-level access or higher can create CSS files in arbitrary directories on the server. On Windows hosts, the same weakness allows deletion of CSS files in any directory writable by the web process. The vendor addressed the issue in changeset 3336533 on the WordPress plugin repository.

Critical Impact
Author-level users can write CSS files to arbitrary directories and, on Windows, delete existing CSS files outside the plugin's intended paths.

Affected Products

Hasthemes HT Mega – Absolute Addons For Elementor (free, WordPress) versions up to and including 2.9.1
WordPress sites that permit Author-level or higher registration
Windows-hosted WordPress installations (increased impact due to file deletion primitive)

Discovery Timeline

2025-07-31 - CVE-2025-8151 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8151

Vulnerability Analysis

The vulnerability originates in the save_block_css function inside the Manage_Styles class of the HT Mega plugin. The function accepts input used to construct a filesystem path for saving generated CSS but fails to normalize or validate that path against an allowlisted directory. An authenticated user with the edit_posts capability (Author role and above) can supply traversal sequences such as ../ to escape the intended wp-content/uploads/htmega-blocks/ directory. The plugin then writes attacker-controlled CSS content to the resolved location. On Windows, path handling differences allow the same code path to be leveraged to delete existing CSS files outside the intended directory. Impact is limited to files with a .css extension, which prevents direct code execution through the primitive but enables denial of styling, defacement of front-end assets, and staging of secondary attacks.

Root Cause

The root cause is missing input sanitization on the filename or path parameter passed to save_block_css. The function relies on user-supplied values to build the destination path without calling a canonicalization routine or verifying that the resolved path stays within the plugin's working directory. The relevant source is visible in the tagged 2.9.1 release at WordPress Plugin Manage Styles Code.

Attack Vector

Exploitation requires network access to the WordPress admin AJAX endpoint and valid credentials at the Author level or above. The attacker submits a crafted request to the AJAX action registered by Manage_Styles, embedding directory traversal sequences in the filename parameter. The server writes the supplied CSS payload to the attacker-selected path. See the Wordfence Vulnerability Analysis for additional detail. No verified public proof-of-concept is available at this time.

Detection Methods for CVE-2025-8151

Indicators of Compromise

Unexpected .css files appearing outside wp-content/uploads/htmega-blocks/ or the active theme directory
Missing or zero-byte CSS files on Windows-hosted WordPress installations running vulnerable HT Mega versions
Requests to admin-ajax.php referencing HT Mega block actions containing ..\ or ../ sequences in POST bodies
Author-level accounts issuing AJAX calls to plugin endpoints outside normal editorial workflows

Detection Strategies

Enable PHP file integrity monitoring on the WordPress installation directory to alert on CSS file creation outside expected paths
Deploy web application firewall rules that inspect admin-ajax.php POST parameters for path traversal patterns targeting HT Mega actions
Review the plugin version reported by wp plugin list --format=json and flag installations at or below 2.9.1

Monitoring Recommendations

Audit WordPress user roles and remove unused Author-and-above accounts that could serve as an exploitation foothold
Correlate authentication logs with AJAX request logs to identify Author-level sessions writing to plugin-related endpoints
Monitor for anomalous CSS content on production pages that may indicate stored defacement payloads

How to Mitigate CVE-2025-8151

Immediate Actions Required

Update HT Mega – Absolute Addons For Elementor to the version released in changeset 3336533 or later
Audit all Author, Editor, and Administrator accounts and revoke access for unused or shared credentials
Search the filesystem for CSS files created outside expected plugin and theme directories and validate their contents

Patch Information

The vendor patched the vulnerability in WordPress Changeset 3336533. The fix updates Manage_Styles.php to sanitize and constrain the destination path before writing block CSS. Site owners should upgrade to the patched release through the WordPress plugin updater or by replacing the plugin directory manually.

Workarounds

Disable and remove the HT Mega plugin until the patched version can be deployed
Restrict Author-level and higher registration and require administrator approval for role assignments
Apply WAF signatures that block ../ and ..\ sequences in HT Mega AJAX action parameters
On Windows hosts, restrict the web server process account so it cannot write or delete files outside the WordPress content directories

bash

# Configuration example: verify installed HT Mega version and update via WP-CLI
wp plugin get ht-mega-for-elementor --field=version
wp plugin update ht-mega-for-elementor
wp plugin get ht-mega-for-elementor --field=version