CVE-2024-5153 is a critical (CVSS 9.1) directory traversal flaw in the Startklar Elementor Addons plugin for WordPress, versions up to and including 1.7.15. Unauthenticated attackers can copy arbitrary server files and delete directories. Update past 1.7.15 or remove the plugin.
What's affected
The record covers the Startklar Elementor Addons plugin (repository slug startklar-elmentor-forms-extwidgets, spelled that way in the plugin directory) in every version up to and including 1.7.15. The vulnerable parameter is dropzone_hash, used by the drop zone form field widget.
No fixed version appears in the record, which cites a source line in widgets/dropzone_form_field.php and a Wordfence entry. Read the plugin changelog to find the first release after 1.7.15 and confirm it before you close the ticket.
How to check if you're exposed
Ask WP-CLI for the version:
wp plugin list --fields=name,version,status | grep -i startklar
On a host without WP-CLI, look in the plugins directory:
ls wp-content/plugins | grep -i startklar
grep -i '^ *Version' wp-content/plugins/startklar-elmentor-forms-extwidgets/*.php | head
Any version of 1.7.15 or lower is in scope. If the plugin is present but not active, treat it as a leftover to delete rather than as safe.
What to do now
- Update the plugin to the newest release and verify the version is above 1.7.15.
- If no fixed release is available to you, deactivate and delete the plugin until one is.
- Confirm you have a recent offsite backup, since the advisory describes deletion of arbitrary directories including the WordPress root.
- Check the site for unexpected file changes and missing directories, and rotate secrets stored in wp-config.php if you see signs of file disclosure.
- Restrict write permissions so the web server user can only write to uploads and cache paths it needs.
Why it matters
The class is CWE-22, improper limitation of a pathname to a restricted directory. The plugin takes a value from the request and uses it to build a filesystem path without confirming the result stays inside the intended folder. Two outcomes follow from the advisory text: reading the contents of files that hold secrets, and deleting directories.
Because no login is needed, any internet facing site running the plugin is reachable. Deleting the root WordPress directory is a destructive outcome, so the backup point above matters as much as the patch. The record does not set the KEV flag.
Quick check
Which part of the request is the problem?
The record names the dropzone_hash parameter. The advisory does not go further and neither do we.
Do I need to be logged in to be affected?
No. The record says unauthenticated attackers can trigger it, which is why the score is 9.1.
Sources
Last reviewed: 19 October 2026.
