PT-2026-33275 · Livemesh · Livemesh Addons By Elementor

Craig Smith · Published 2026-04-16 · Updated 2026-04-16 · CVE-2026-1620

NVD

CVSS v3.1

8.8

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The Livemesh Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 9.0. This is due to insufficient sanitization of the template name parameter in the lae get template part() function, which uses an inadequate str replace() approach that can be bypassed using recursive directory traversal patterns. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the attacker to include and execute local files via the widget's template parameter granted they can trick an administrator into performing an action or install Elementor.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2026-1620

Affected Products

Livemesh Addons By Elementor

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-1620 · Security Note
• https://plugins.trac.wordpress.org/browser/addons-for-elementor/trunk/includes/helper-functions.php#L669 · Note
• https://plugins.trac.wordpress.org/browser/addons-for-elementor/tags/9.0/includes/helper-functions.php#L671 · Note
• https://plugins.trac.wordpress.org/browser/addons-for-elementor/tags/9.0/includes/helper-functions.php#L669 · Note
• https://twitter.com/CVEnew/status/2044701559658037733 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/2483875a-84de-4a40-a69e-aee68da1ce3b?source=cve · Note
• https://plugins.trac.wordpress.org/browser/addons-for-elementor/trunk/includes/helper-functions.php#L671 · Note