PT-2024-20120 · Livemesh · Elementor Addons

Wesley

·

Published

2024-07-04

·

Updated

2024-07-08

·

CVE-2024-2385

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Elementor Addons by Livemesh plugin for WordPress versions up to, and including, 8.3.7
Description The issue allows authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server through several of the plugin's widgets via the style attribute. This enables the execution of any PHP code in those files, which can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Recommendations For versions up to, and including, 8.3.7, update to a version higher than 8.3.7 to resolve the issue. As a temporary workaround, consider restricting access to the style attribute in the plugin's widgets to minimize the risk of exploitation. Additionally, restrict the upload of files to only necessary types and ensure proper validation and sanitization of uploaded files to prevent arbitrary file inclusion.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-2385

Affected Products

Elementor Addons