Arbitrary File Read Vulnerability in Elementor Plugin for WordPress

CVE-2025-8081

What is CVE-2025-8081?

The Elementor plugin for WordPress is susceptible to an Arbitrary File Read vulnerability. This issue arises in all versions up to and including 3.30.2, specifically within the Import_Images::import() function. The vulnerability is due to a lack of proper filename validation, allowing authenticated users with administrator-level access to exploit this weakness. By manipulating the filename, attackers can potentially gain access to sensitive files on the server, posing significant risks to the overall integrity and confidentiality of data.

References