CVE-2026-39754— WordPress Piotnet Addons For Elementor plugin <= 7.1.71 - Arbitrary File Download vulnerability
Quick assessment
Affected
About Piotnet Piotnet Addons For Elementor
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Piotnet Addons For Elementor ≤ 7.1.71 版本中存在任意文件下载漏洞，允许贡献者下载任意文件。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-39754
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress Piotnet Addons For Elementor plugin <= 7.1.71 - Arbitrary File Download vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Contributor Arbitrary File Download in Piotnet Addons For Elementor <= 7.1.71 versions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| About Piotnet | Piotnet Addons For Elementor | n/a ~ 7.1.71 | - |
|
II. Public POCs for CVE-2026-39754
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-39754
请登录查看更多情报信息。
Other References for CVE-2026-39754 (1)
IV. Related Vulnerabilities
Same product: Piotnet Addons For Elementor
-
CVE-2024-13650
Piotnet Addons For Elementor <= 2.4.36 - Authenticated (Cont -
CVE-2025-32197
WordPress Piotnet Addons For Elementor plugin <= 2.4.36 - Cr -
CVE-2024-10775
Piotnet Addons For Elementor <= 2.4.32 - Authenticated (Cont -
CVE-2025-22333
WordPress Piotnet Addons For Elementor plugin <= 2.4.31 - Cr -
CVE-2024-5502
Piotnet Addons For Elementor <= 2.4.30 - Authenticated (Cont
Same weakness: CWE-22
-
CVE-2026-39792
WordPress Simple File List plugin <= 6.3.11 - Arbitrary File -
CVE-2026-39752
WordPress Jobs for WordPress plugin <= 2.8.2 - Arbitrary Fil -
CVE-2026-105751
Docling: Arbitrary local file read via draw:image xlink:href -
CVE-2026-105744
Docling: Arbitrary file read/write (and command execution wh -
CVE-2026-105677
Ghost: Remote Code Execution via Theme Translation Files
V. Comments for CVE-2026-39754
No comments yet