CVE-2024-4359: Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.2 - Authenticated (Contributor+) Arbitrary File Read
The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to arbitrary file reads in all versions up to, and including, 5.7.2 via the SVG widget and a lack of sufficient file validation in the rendersvg function. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4359?
The severity of CVE-2024-4359 is considered high due to the potential for arbitrary file reading.
How do I fix CVE-2024-4359?
To fix CVE-2024-4359, update the Element Pack Elementor Addons plugin to version 5.7.3 or later.
What types of attacks can exploit CVE-2024-4359?
CVE-2024-4359 can be exploited to read sensitive files on the server, leading to information disclosure.
Which versions of the Element Pack Elementor Addons are affected by CVE-2024-4359?
All versions of the Element Pack Elementor Addons up to and including 5.7.2 are affected by CVE-2024-4359.
Is CVE-2024-4359 specific to any particular WordPress installation?
CVE-2024-4359 affects all WordPress installations that have the vulnerable versions of the Element Pack Elementor Addons plugin.