The Elementor Addon Elements plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.12.12 via the render function. This makes it possible for authenticated attackers, with contributor access or higher, to include the contents of arbitrary PHP files on the server, which may expose sensitive information.
References
Configurations
History
17 Jan 2025, 19:52
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| First Time |
Webtechstreet
Webtechstreet elementor Addon Elements |
|
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/20cd3fff-0488-4bc2-961b-2427925e6a96?source=cve - Third Party Advisory | |
| References | () https://plugins.trac.wordpress.org/changeset/3037925/addon-elements-for-elementor-page-builder/trunk/modules/shape-separator/widgets/shape-separator.php - Patch | |
| References | () https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/tags/1.12.12/modules/shape-separator/widgets/shape-separator.php#L89 - Product | |
| CWE | CWE-22 | |
| CPE | cpe:2.3:a:webtechstreet:elementor_addon_elements:*:*:*:*:*:wordpress:*:* |
13 Mar 2024, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-03-13 16:15
Updated : 2025-01-17 19:52
NVD link : CVE-2024-1358
Mitre link : CVE-2024-1358
JSON object : View
Products Affected
webtechstreet
- elementor_addon_elements
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')