Arbitrary File Inclusion Vulnerability in WPZOOM Addons for Elementor
CVE-2024-5147

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
WPzoom Addons For Elementor – Starter Templates & Widgets
Vendor
CVE Published:
22 May 2024

What is CVE-2024-5147?

The WPZOOM Addons for Elementor plugin for WordPress is susceptible to a Local File Inclusion vulnerability due to improper handling of the 'grid_style' parameter. This security flaw allows unauthenticated attackers to include and execute arbitrary files on the server, thereby executing malicious PHP code contained within those files. As a result, attackers could potentially circumvent access controls, access sensitive information, or execute unauthorized code especially through uploads of images or other seemingly harmless file types.

Affected Version(s)

WPZOOM Addons for Elementor – Starter Templates & Widgets 0 <= 1.1.37

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wpzoom-element...
https://plugins.trac.wordpress.org/browser/wpzoom-element...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Craig Smith
.