Arbitrary File Inclusion Vulnerability in The Plus Addons for Elementor Plugin
CVE-2024-2203

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
The Plus Addons For Elementor – Addons For Elementor, Page Templates, Widgets, Mega Menu, WooCommerce
Vendor
CVE Published:
27 March 2024

What is CVE-2024-2203?

The Plus Addons for Elementor plugin for WordPress is affected by a Local File Inclusion vulnerability that allows authenticated attackers with contributor-level access and above to exploit the Clients widget. This vulnerability enables the inclusion and execution of arbitrary files on the server, which can lead to the execution of malicious PHP code. It poses significant risks, such as bypassing access controls, retrieving sensitive information, and potential code execution via seemingly harmless file uploads, especially images.

Affected Version(s)

The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce 0 <= 5.4.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3056776/the-...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

wesley
.