Arbitrary File Inclusion Vulnerability in ElementsKit Pro Plugin for WordPress

CVE-2024-3500

Summary

The ElementsKit Pro plugin for WordPress, developed by WPMet, is vulnerable to Local File Inclusion (LFI) across all versions up to and including 3.6.0. This vulnerability arises through specific widgets such as Price Menu, Hotspot, and Advanced Toggle. Authenticated attackers, particularly those with contributor-level access or higher, may exploit this flaw to include arbitrary files on the server. This capability allows attackers to execute any PHP code contained within those files, potentially bypassing access controls and exposing sensitive data. The risk is compounded by the ability to upload seemingly 'safe' file types like images, which can then be leveraged for malicious purposes.

References