Local File Inclusion Vulnerability in Livemesh Addons for Elementor by WordPress

CVE-2026-1620

What is CVE-2026-1620?

The Livemesh Addons for Elementor plugin for WordPress has a vulnerability that allows for Local File Inclusion due to inadequate sanitization in the lae_get_template_part() function. Specifically, the function's use of str_replace() can be circumvented through recursive directory traversal patterns. This weakness enables authenticated attackers with Contributor access or higher to include and execute arbitrary files on the server. The attacker must deceive an administrator into performing an action or require Elementor to be installed to exploit this vulnerability effectively.

References