Arbitrary File Inclusion Vulnerability in ElementsKit Elementor Addons Plugin

CVE-2024-2047

Summary

The ElementsKit Elementor addons plugin for WordPress is affected by a Local File Inclusion vulnerability that allows authenticated users with contributor-level access and above to include and execute arbitrary files on the server. This flaw is found in all versions up to and including 3.0.6, specifically through the 'render_raw' function. By exploiting this vulnerability, attackers can bypass access controls, execute arbitrary PHP code, and potentially expose sensitive data. The ability to upload and include what are perceived as safe file types, like images, further exacerbates the risk, making it essential for users to secure their installations against this vulnerability.

References