Arbitrary File Inclusion Vulnerability in The Plus Addons for Elementor Plugin

CVE-2024-2203

Summary

The Plus Addons for Elementor plugin for WordPress is affected by a Local File Inclusion vulnerability that allows authenticated attackers with contributor-level access and above to exploit the Clients widget. This vulnerability enables the inclusion and execution of arbitrary files on the server, which can lead to the execution of malicious PHP code. It poses significant risks, such as bypassing access controls, retrieving sensitive information, and potential code execution via seemingly harmless file uploads, especially images.

References