CVE-2023-6214: Hasthemes Ht Mega

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.6 via the purchased_products function. This makes it possible for unauthenticatied attackers to extract sensitive data including the previous 7 days of order data including products and customer PII.

Affected products

• Hasthemes Ht Mega: before 2.4.7 (fixed in 2.4.7)

Published 2024-05-02. Last modified 2026-06-17.