Arbitrary File Inclusion Vulnerability in WPZOOM Addons for Elementor

CVE-2024-5147

What is CVE-2024-5147?

The WPZOOM Addons for Elementor plugin for WordPress is susceptible to a Local File Inclusion vulnerability due to improper handling of the 'grid_style' parameter. This security flaw allows unauthenticated attackers to include and execute arbitrary files on the server, thereby executing malicious PHP code contained within those files. As a result, attackers could potentially circumvent access controls, access sensitive information, or execute unauthorized code especially through uploads of images or other seemingly harmless file types.

References