The Hide My WP Lite plugin (versions 1.3 and earlier) concatenates unvalidated user input from the he_wrapper_js and he_wrapper_css query parameters directly onto the absolute path of the host, which is then passed to file_get_contents and echoed to the client. This flaw allows any attacker to read the contents of any file that the web server can access, including wp-config.php. The wp_kses_post handler contents, so the attacker obtains sensitive configuration and credentials. The a classic path traversal (CWE-22).

WordPress sites running Hide My WP Lite version 1.3 or older from templatic1, with the Elementor plugin installed and its Hide Elementor feature enabled, are vulnerable releases or that do not have Elementor are not affected.

The vulnerability has a CVSS score of 7.5, indicating high severity, while the EPSS score of less than 1% shows a very low but non‑zero probability of exploitation. It is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be sending a normal HTTP request with a crafted he_wrapper_js or he_wrapper_css parameter containing a path‑traversal sequence; no authentication is required. The exploit requires the Elementor plugin and the Hide Elementor feature to be active, but once triggered the attacker can read any file accessible to the web‑server process, potentially exposing credentials and other sensitive data.