Remote File Inclusion Vulnerability in Qi Addons For Elementor Plugin

CVE-2024-4887

Summary

The Qi Addons For Elementor plugin for WordPress contains a vulnerability that allows Remote File Inclusion through the 'behavior' attributes in the qi_addons_for_elementor_blog_list shortcode. Attackers with Contributor-level access or higher can exploit this flaw to include arbitrary remote files on the server, potentially leading to unauthorized code execution. Successful exploitation hinges on the attacker being able to create a non-existent directory or finding a target instance where the file_exists function will not return false for a non-existent directory, facilitating the inclusion of malicious code.

References