Arbitrary File Inclusion Vulnerability in JetTabs for Elementor

CVE-2024-7146

What is CVE-2024-7146?

The JetTabs for Elementor plugin for WordPress is susceptible to Local File Inclusion due to the improper handling of the 'switcher_preset' parameter. This vulnerability allows authenticated users with Contributor-level access to include and execute arbitrary files on the server. Attackers can exploit this flaw to bypass access controls, execute unwanted PHP code, and potentially retrieve sensitive information from the server. The issue affects all versions up to and including 2.2.3, emphasizing the need for immediate attention to maintain the integrity of WordPress installations using this plugin.

References