CVE-2024-1974 – This vulnerability in the HT Mega plugin for Wo... (How to Fix)

Q: What is the severity of CVE-2024-1974?

CVE-2024-1974 has a CVSS score of 8.8 (HIGH). This vulnerability in the HT Mega plugin for WordPress allows authenticated attackers with contributor-level access or higher to perform directory traversal attacks. They can read arbitrary files on the server, potentially exposing sensitive information like configuration files, passwords, or database credentials. All WordPress sites using vulnerable versions of this plugin are affected.

📋 TL;DR

This vulnerability in the HT Mega plugin for WordPress allows authenticated attackers with contributor-level access or higher to perform directory traversal attacks. They can read arbitrary files on the server, potentially exposing sensitive information like configuration files, passwords, or database credentials. All WordPress sites using vulnerable versions of this plugin are affected.

💻 Affected Systems

Products:

HT Mega - Absolute Addons For Elementor WordPress Plugin

Versions: All versions up to and including 2.4.6

Operating Systems: All operating systems running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires attacker to have at least contributor-level WordPress user account. Plugin must be active and vulnerable version installed.

📦 What is this software?

Ht Mega by Hasthemes

View all CVEs affecting Ht Mega →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers gain full access to sensitive server files including wp-config.php (containing database credentials), other configuration files, and potentially user data, leading to complete site compromise.

🟠

Likely Case

Attackers exfiltrate configuration files containing database credentials, leading to database access and potential data theft or site defacement.

🟢

If Mitigated

With proper file permissions and security controls, attackers can only read publicly accessible files, limiting exposure to non-sensitive information.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access but is technically simple. Public proof-of-concept code exists in vulnerability reports.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.4.7

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3048999/ht-mega-for-elementor/tags/2.4.7/includes/widgets/htmega_weather.php

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Go to Plugins → Installed Plugins. 3. Find 'HT Mega - Absolute Addons For Elementor'. 4. Click 'Update Now' if update is available. 5. Alternatively, download version 2.4.7+ from WordPress repository and manually update.

🔧 Temporary Workarounds

Remove Contributor Access

all

Temporarily remove contributor-level user accounts or restrict their permissions until patch is applied.

Disable Plugin

all

Deactivate the HT Mega plugin if not critically needed until patched.

🧯 If You Can't Patch

Implement strict file permissions (e.g., 600 for sensitive files, 755 for directories) to limit readable files
Use web application firewall (WAF) rules to block directory traversal patterns in requests

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Installed Plugins for HT Mega plugin version. If version is 2.4.6 or lower, you are vulnerable.

Check Version:

wp plugin list --name="HT Mega" --field=version (if WP-CLI installed) or check WordPress admin plugins page

Verify Fix Applied:

After updating, verify plugin version shows 2.4.7 or higher in WordPress plugins list.

📡 Detection & Monitoring

Log Indicators:

Unusual file read requests in web server logs containing '../' sequences
Multiple failed authentication attempts followed by successful contributor-level login

Network Indicators:

HTTP requests with '../' patterns in parameters to HT Mega endpoints

SIEM Query:

web_access_logs WHERE url CONTAINS "htmega_weather" AND (url CONTAINS "../" OR parameters CONTAINS "../")

📊 Metadata

CVE ID: CVE-2024-1974

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-22

Published: April 9, 2024

Last Updated: January 22, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-1974, you might also want to check these: