Executive brief
The Hide My WP Lite plugin for WordPress, which is used to enhance website security by hiding common WordPress paths, contains a vulnerability that allows unauthorized users to read sensitive files from the server. An attacker could use this flaw to access critical configuration files like wp-config.php, which often contains database credentials and encryption keys. This could lead to a full site takeover or the theft of sensitive customer data.
Technical details
An arbitrary file read vulnerability exists in the Hide My WP Lite plugin (versions <= 1.3) due to insufficient input validation in the elementor_assets_filter() function. The function takes user input from the 'he_wrapper_js' and 'he_wrapper_css' query parameters and concatenates it directly with the ABSPATH constant before passing it to file_get_contents(). Because there is no path traversal validation, allow-listing, or extension checking, an unauthenticated attacker can use directory traversal sequences to read any file on the server that the web server process has permissions to access. The exploit requires the Elementor plugin to be installed and the 'Hide Elementor' feature to be enabled within the Hide My WP Lite settings.
Affected products
- templatic1 Hide My WP Lite <= 1.3
Timeline
- 2026-07-10: disclosed
- 2026-07-10: advisory