Cowidgets Elementor Addons Plugin Vulnerable to Local File Inclusion

CVE-2024-5179

Summary

The Cowidgets Elementor Addons plugin for WordPress is susceptible to a Local File Inclusion vulnerability that affects all versions up to and including 1.1.1. This vulnerability arises from improper validation of the 'item_style' and 'style' parameters, allowing authenticated attackers with Contributor-level access or higher to include and execute arbitrary files on the server. This exploitation can lead to the execution of malicious PHP code, enabling attackers to bypass access controls, access sensitive information, and execute arbitrary code through seemingly benign file types like images. Prompt update or mitigation is advised to protect against these risks.

References