PT-2023-30345 · Elementor · The Plus Addons For Elementor

Rafie Muhammad · Published 2023-11-08 · Updated 2025-01-29 · CVE-2023-47178

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Plus Addons for Elementor Pro versions n/a through 5.2.8

Description The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a 'Path Traversal' vulnerability, which allows PHP Local File Inclusion. This vulnerability affects The Plus Addons for Elementor Pro, allowing potential access to sensitive files.

Recommendations For versions n/a through 5.2.8, update to a version later than 5.2.8 to resolve the issue. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-47178

Affected Products

The Plus Addons For Elementor

References · 9

• https://osv.dev/vulnerability/CVE-2023-47178 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-47178 · Security Note
• https://patchstack.com/database/vulnerability/theplus_elementor_addon/wordpress-the-plus-addons-for-elementor-pro-plugin-5-2-8-unauthenticated-local-file-inclusion-vulnerability?_s_id=cve · Note
• https://t.me/cvenotify/80209 · Telegram Post
• https://t.me/cvenotify/109019 · Telegram Post
• https://twitter.com/CVEnew/status/1791390956866142313 · Twitter Post
• https://twitter.com/CveFindCom/status/1791409047872078019 · Twitter Post
• https://twitter.com/RsSI47041968/status/1722307009146700026 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1791427766249771096 · Twitter Post