CVE-2024-1358

The vulnerability present in the Elementor Addon Elements plugin for WordPress is characterized by a directory traversal flaw that affects all versions up to and including 1.12.12. This type of vulnerability allows an attacker to manipulate file paths in a way that enables them to access files and directories that are outside the intended scope of the application. Specifically, the issue arises within the render function of the plugin, which fails to adequately validate user input. As a result, authenticated users with contributor access or higher can exploit this weakness to include arbitrary PHP files from the server. This can lead to unauthorized access to sensitive information, potentially compromising the integrity and confidentiality of the web application.

The attack vectors for this vulnerability are particularly concerning due to the relatively low barrier to entry for potential attackers. Since only authenticated users with contributor privileges can exploit the flaw, it is likely that the attacker may already have some level of access to the WordPress environment. This could include users who have been granted permissions for legitimate purposes but may have malicious intent. An attacker could craft a request that manipulates the file path, allowing them to include sensitive files such as configuration files, database credentials, or even other PHP scripts that could facilitate further exploitation of the server. The exploitation of this vulnerability could lead to a complete compromise of the affected WordPress instance, allowing attackers to execute arbitrary code or escalate their privileges.

The real-world impact of this vulnerability can be significant, particularly for businesses that rely on WordPress for their online presence. The exposure of sensitive information can lead to data breaches, loss of customer trust, and potential legal ramifications. Additionally, if an attacker gains control over the server, they could deploy malware, deface the website, or use it as a launching point for attacks against other systems. The business risk associated with this vulnerability is compounded by the fact that many organizations may not have adequate security measures in place to detect or respond to such attacks. The potential for reputational damage and financial loss makes it imperative for organizations to take this vulnerability seriously.

To detect and mitigate the risks associated with this vulnerability, organizations should implement a multi-layered security approach. First and foremost, it is crucial to ensure that all plugins, including the Elementor Addon Elements, are kept up to date with the latest security patches. Regularly auditing user permissions can also help limit the number of authenticated users who have access to potentially exploit the vulnerability. Additionally, employing web application firewalls (WAFs) can provide an additional layer of protection by filtering out malicious requests that attempt to exploit directory traversal flaws. Monitoring server logs for unusual access patterns or file inclusion attempts can also aid in early detection of potential exploitation.

In conclusion, the directory traversal vulnerability in the Elementor Addon Elements plugin poses a significant threat to WordPress installations, particularly for those with inadequate security measures. The ability for authenticated users to include arbitrary PHP files can lead to severe consequences, including data breaches and server compromise. Organizations must prioritize timely updates, user access management, and proactive monitoring to mitigate the risks associated with this vulnerability effectively. By adopting a comprehensive security strategy, businesses can better protect themselves against the potential fallout from such vulnerabilities.

The CVSS score for CVE-2024-1358 has been revised upward from 6.5 to 8.8, reflecting a reassessment of the vulnerability’s impact and exploitability. This adjustment underscores a heightened risk profile, emphasizing that authenticated contributors can leverage the directory traversal flaw to include arbitrary PHP files, potentially leading to critical data exposure or server compromise. Although CSURFACE threat intelligence has not detected new exploit activity or proof-of-concept developments, the elevated severity score signals increased urgency for defenders to recognize the vulnerability’s potential for significant operational disruption. Our telemetry indicates that exploitation attempts remain stable without a marked escalation; however, the higher CVSS rating aligns with a broader industry consensus on the vulnerability’s seriousness. Consequently, the threat level should be considered elevated, warranting closer attention in risk management and monitoring strategies.

Update 2 — June 13, 2026

The CVSS score adjustment for CVE-2024-1358 from 8.8 to 6.5 reflects a refined understanding of the vulnerability’s exploitability and impact based on recent analysis. This recalibration indicates that while the vulnerability remains a credible risk, particularly for authenticated users with contributor-level access or higher, its potential for widespread or severe operational disruption is less acute than initially assessed. CSURFACE threat intelligence notes that the exploit prediction scoring (EPSS) remains low and stable, reinforcing that active exploitation or rapid adoption by threat actors has not materialized. Consequently, the threat level should be viewed as moderate, emphasizing the need for continued vigilance but without the urgency associated with higher-severity vulnerabilities. This nuanced risk profile assists defenders in prioritizing resources effectively, balancing the vulnerability’s presence against the current exploit landscape and observed attacker behavior.