nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-2047 CVE-2024-2047
HIGH
ElementsKit Elementor addons <= 3.0.6 - Authenticated (Contributor+) Local File Inclusion in render_raw
Record summary
CVE-2024-2047 has a selected CVSS score of 8.8 (high).
Description
The ElementsKit Elementor addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.6 via the render_raw function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 1, 2024 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for ElementorBrowse roxnor / ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for ElementorDefault status: unaffected | CVE List | Through 3.0.6 | affected |
elements_kit_elementor_addonsBrowse wpmet / elements_kit_elementor_addonsDefault status: unaffected | CVE List | Through 3.0.6 | affected |
References
4plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/elementskit-lite/tags/3.0.5/widgets/testimonial/testimonial.php plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3054091/elementskit-lite/tags/3.0.7/widgets/testimonial/testimonial.php wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/413e6326-14c6-4734-8adc-114a7842c574?source=cve