CVE-2023-37999: Critical Privilege Escalation in HT Mega

CVE-2023-37999 is a critical severity (CVSS 9.8) improper privilege management flaw in HT Mega, the Absolute Addons for Elementor plugin from HasThemes, in versions through 2.2.0. The vector needs no login and no user action. Update the plugin to the latest release now and review your administrator accounts.

What's affected

The NVD record lists HT Mega as affected "from n/a through 2.2.0", which is Patchstack wording for every release up to and including 2.2.0. The record scores the flaw 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The weakness is tracked as CWE-269 (improper privilege management).

The vector says the attack is network based, needs no privileges and no user interaction, and has high impact on confidentiality, integrity and availability. That is the profile of a full site takeover. The Patchstack reference title calls it an unauthenticated privilege escalation vulnerability, which fits the vector.

The record names no fixed version, and the Patchstack page it links to could not be retrieved when we reviewed it (the request returned an error). The CVE is not flagged in CISA KEV in the record, and nothing we read says it is exploited in the wild. For the fixed release, check the vendor changelog or the Patchstack entry.

How to check if you're exposed

If you run WP-CLI, list the installed version and status of the plugin:

wp plugin list --fields=name,version,status,update

Look for HT Mega in the output. Anything at 2.2.0 or lower is in the affected range. In the dashboard the same information is under Plugins, Installed Plugins. On a fleet of sites, run the command per site or through your management tool, and include staging and forgotten test copies.

You can also check your dependency manifests and images. A free in-browser scan at gold.safeguard.sh/scan takes a package.json, a requirements.txt or an SBOM and shows known CVEs, though WordPress plugins are usually tracked by the CMS rather than a package manager, so keep a separate list of them.

What to do now

1. List every WordPress site you run and note whether HT Mega is installed and at what version.
2. Update HT Mega to the newest release the vendor offers. If the update is behind a license, renew it or plan the change, because the old version stays vulnerable.
3. If you cannot update today, deactivate the plugin on sites where it is not needed, or restrict access to the affected features with a web application firewall rule from your provider.
4. Because this is a takeover class flaw, check the user list for administrators you did not create and review recent plugin installs and file changes.
5. Review user accounts and recent changes on any site that ran the affected version for a while, and remove accounts you do not recognise.
6. Add the plugin to a watch list so the next advisory reaches you the day it is published.

Why it matters

Improper privilege management means the plugin lets a caller get rights it should not hold. On WordPress that usually means an anonymous request can make itself an administrator or change a user role, after which the attacker can install plugins, edit code and read the database. The record does not describe the exact path, and we will not guess at it.

A critical rating with no prerequisites is the case where speed matters. Update first, then check. Look at your user list for administrators you did not create, check recently installed plugins, and review file changes in the plugin and upload folders. A clean result after the update is good news, but only checking can show it.

Try it yourself

The quickest win with a flaw like this is knowing that a fixed release already exists and where it is. This demo shows how a fix available signal changes triage.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Patchstack entry (linked from the NVD record; it could not be retrieved when we reviewed it)
• CVE-2023-37999 on Gold

Last reviewed: 19 October 2026.