The HT Mega plugin for WordPress has a path traversal vulnerability in the save_block_css method that lets an authenticated user with author or higher privileges create or delete CSS files in any directory on a Windows installation. The flaw enables the attacker to overwrite existing style files or remove them, which can alter the appearance of the website or be a stepping stone for further attacks. This weakness is a classic path traversal (CWE-22) and does not provide remote code execution directly.

The vulnerability affects devitemsllc's HT Mega Addons for Elementor – Elementor Widgets & Template Builder, versions up to and including 2.9.1 in the free WordPress distribution. It is confirmed on Windows environments; other operating systems have not been verified.

The CVSS score is 4.3, indicating low severity, and the EPSS score is below 1%, meaning exploitation probability is currently minimal. The vulnerability is not in the CISA KEV catalog. Exploitation requires the attacker to be authenticated with author-level or higher access and to be able to invoke the save_block_css operation, likely through the plugin's UI or crafted requests. The risk is confined to compromised or malicious users with sufficient privileges, as the attack vector is internal and depends on authenticated access.