Arbitrary File Inclusion Vulnerability in Elementor Addons by Livemesh Plugin

CVE-2024-2385

Summary

The Elementor Addons by Livemesh plugin for WordPress is susceptible to a Local File Inclusion vulnerability impacting all versions up to and including 8.3.7. This security flaw arises from the improper handling of the 'style' attribute within multiple widgets of the plugin. Authenticated attackers with contributor-level access or higher can leverage this vulnerability to include and execute arbitrary files on the server, which enables them to run any PHP code found in these files. The implications of this vulnerability include potential bypassing of access controls, unauthorized retrieval of sensitive information, and arbitrary code execution, particularly where users can upload images and other ostensibly safe file types.

References