CVE-2024-1358: Path Traversal
First published: Wed Mar 13 2024(Updated: )
The Elementor Addon Elements plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.12.12 via the render function. This makes it possible for authenticated attackers, with contributor access or higher, to include the contents of arbitrary PHP files on the server, which may expose sensitive information.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| webtechstreet Elementor Addon Elements | <1.13 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/tags/1.12.12/modules/shape-separator/widgets/shape-separator.php#L89
- https://plugins.trac.wordpress.org/changeset/3037925/addon-elements-for-elementor-page-builder/trunk/modules/shape-separator/widgets/shape-separator.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/20cd3fff-0488-4bc2-961b-2427925e6a96?source=cve
Frequently Asked Questions
What is the severity of CVE-2024-1358?
CVE-2024-1358 is considered a critical severity vulnerability due to its potential for unauthorized file inclusion.
How do I fix CVE-2024-1358?
To fix CVE-2024-1358, update the Elementor Addon Elements plugin to version 1.13 or higher.
Who is affected by CVE-2024-1358?
Authenticated users with contributor permissions or higher are affected by CVE-2024-1358.
What type of vulnerability is CVE-2024-1358?
CVE-2024-1358 is a Directory Traversal vulnerability that allows inclusion of arbitrary PHP files.
Which versions of the Elementor Addon Elements plugin are affected by CVE-2024-1358?
All versions up to and including 1.12.12 of the Elementor Addon Elements plugin are affected by CVE-2024-1358.
- agent/references
- agent/description
- agent/author
- agent/type
- agent/weakness
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/remedy
- agent/last-modified-date
- agent/event
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/webtechstreet
- canonical/webtechstreet elementor addon elements