CVE-2026-13347: Hide My WP Lite Path Traversal Flaw

CVE-2026-13347 Overview

CVE-2026-13347 is an arbitrary file read vulnerability affecting the Hide My WP Lite plugin for WordPress in versions up to and including 1.3. The flaw resides in the elementor_assets_filter() function, which concatenates attacker-controlled input from the he_wrapper_js and he_wrapper_css query parameters directly onto ABSPATH before passing the value to file_get_contents(). Unauthenticated attackers can read arbitrary files on the server, including wp-config.php, which contains database credentials and secret keys. Exploitation requires the Elementor plugin and the Hide Elementor feature to be enabled on the target site.

Critical Impact
Unauthenticated remote attackers can disclose the contents of arbitrary files on affected WordPress servers, including credentials stored in wp-config.php.

Affected Products

Hide My WP Lite plugin for WordPress, versions up to and including 1.3
WordPress installations with the Elementor plugin active
WordPress installations with the Hide Elementor feature enabled

Discovery Timeline

2026-07-10 - CVE-2026-13347 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-13347

Vulnerability Analysis

The vulnerability is a path traversal weakness classified under [CWE-22]. The elementor_assets_filter() function in the Hide My WP Lite plugin processes two request parameters, he_wrapper_js and he_wrapper_css, without validating their contents. The plugin appends the raw input to the WordPress ABSPATH constant and passes the resulting path to PHP's file_get_contents(). The returned contents are then echoed back in the HTTP response after being passed through wp_kses_post(). Because wp_kses_post() only sanitizes HTML tags and attributes, it does not prevent disclosure of file contents such as PHP source, configuration files, or environment secrets.

Root Cause

The root cause is missing input validation. The function lacks path traversal filtering, an allow-list of permitted files, realpath() containment checks against a base directory, and file extension restrictions. Any string that resolves to a readable path on the underlying filesystem is fetched and returned.

Attack Vector

An unauthenticated attacker sends an HTTP request containing a he_wrapper_js or he_wrapper_css query parameter with a traversal sequence such as ../../../../wp-config.php. The plugin concatenates the value onto ABSPATH, reads the resulting file, and echoes its contents in the response. This exposes database credentials, authentication salts, and other sensitive configuration values that facilitate follow-on attacks including database access and session forgery.

No verified proof-of-concept code has been published. Refer to the Wordfence Vulnerability Analysis and the affected WordPress Plugin Code Snippet for source-level details.

Detection Methods for CVE-2026-13347

Indicators of Compromise

HTTP requests containing he_wrapper_js or he_wrapper_css query parameters with directory traversal sequences such as ../ or URL-encoded variants like %2e%2e%2f.
Access log entries showing requests to WordPress endpoints that reference wp-config.php, .env, or files outside the web root.
HTTP responses from the affected site containing PHP configuration constants such as DB_PASSWORD, AUTH_KEY, or SECURE_AUTH_SALT.

Detection Strategies

Inspect web server access logs for query strings containing he_wrapper_js= or he_wrapper_css= followed by path traversal patterns.
Deploy a web application firewall rule that blocks traversal sequences on any request parameter targeting Hide My WP Lite endpoints.
Baseline outbound response body sizes for the affected endpoints and alert on anomalous large responses that may indicate file exfiltration.

Monitoring Recommendations

Enable request body and response header logging on WordPress sites running Elementor and Hide My WP Lite.
Alert on repeated unauthenticated requests to the same endpoint from a single source IP within a short window.
Monitor filesystem read events on wp-config.php and other sensitive files initiated by the PHP worker process.

How to Mitigate CVE-2026-13347

Immediate Actions Required

Deactivate the Hide My WP Lite plugin on all WordPress sites until a patched version is installed.
Rotate all secrets present in wp-config.php, including database credentials and WordPress authentication keys and salts.
Review web server access logs for prior exploitation attempts referencing the vulnerable parameters.

Patch Information

At the time of publication, no fixed version of the Hide My WP Lite plugin has been listed in the NVD entry. Monitor the Wordfence Vulnerability Analysis advisory and the WordPress plugin repository for a patched release, and update immediately once available.

Workarounds

Disable the Hide Elementor feature within the Hide My WP Lite plugin, which is required for exploitation.
Block requests containing he_wrapper_js or he_wrapper_css parameters at the web application firewall or reverse proxy layer.
Restrict PHP file read permissions so the web server user cannot read wp-config.php outside of application bootstrap.

bash

# Example ModSecurity rule to block traversal in vulnerable parameters
SecRule ARGS:he_wrapper_js|ARGS:he_wrapper_css "@rx (\.\./|%2e%2e%2f|%2e%2e/)" \
    "id:1013347,phase:2,deny,status:403,log,msg:'CVE-2026-13347 Hide My WP Lite path traversal attempt'"