The HT Mega – Absolute Addons For Elementor plugin for WordPress contains an improper authorization check on the 'ajax_trash_templates' function in all versions up to and including 2.9.1. This flaw allows authenticated attackers with Contributor-level access or higher to delete arbitrary attachment files and move arbitrary posts, pages, and templates to the Trash without proper permission verification. The consequence is loss of content and potential disruption of website functionality, affecting the integrity of data within the site.

All installations of the HT Mega – Absolute Addons For Elementor WordPress plugin provided by devitemsllc, specifically versions 2.9.1 and earlier. The plugin is distributed for free and appears in the WordPress repository under the name HT Mega. Users who have not updated beyond version 2.9.1 are vulnerable.

The CVSS score of 4.3 indicates a medium severity vulnerability, while the EPSS of less than 1% indicates a very low probability of exploitation in the wild. The flaw is not currently listed in the CISA KEV catalog. Attackers must authenticate to the WordPress site with at least Contributor privileges to exploit this weakness. The likely attack vector is a web request to the AJAX endpoint 'ajax_trash_templates', where the plugin fails to verify the requesting user’s capability properly. Because the vulnerability requires legitimate site access, detection may rely on monitoring for unexpected content deletions, but should be mitigated by applying a patch or disabling the affected functionality.