CVE-2024-2047 in Elementor Addons Plugin
Summary
by MITRE • 03/30/2024
The ElementsKit Elementor addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.6 via the render_raw function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/14/2026
The vulnerability identified as CVE-2024-2047 affects the ElementsKit Elementor addons plugin for WordPress, representing a critical local file inclusion flaw that has been present in all versions up to and including 3.0.6. This security weakness resides within the render_raw function of the plugin, which processes user-supplied input without adequate validation or sanitization. The vulnerability specifically targets authenticated attackers who possess contributor-level access or higher permissions within WordPress, making it particularly concerning as it can be exploited by users who already have partial control over the system. The flaw allows for arbitrary file inclusion and execution, creating a pathway for attackers to run malicious PHP code on the affected server. This represents a severe escalation of privileges vulnerability that can be leveraged for extensive system compromise.
The technical exploitation of this vulnerability occurs through the improper handling of file paths within the render_raw function, which fails to properly validate or sanitize input parameters. When an authenticated user with contributor privileges or higher submits crafted input to the plugin's rendering functionality, the system processes this input without sufficient security controls, allowing attackers to specify local file paths that can be included and executed. This type of vulnerability falls under CWE-22, which specifically addresses Improper Limitation of a Pathname to a Restricted Directory, and also aligns with CWE-94, which covers the execution of arbitrary code through inadequate input validation. The vulnerability can be exploited to bypass access controls, potentially allowing attackers to read sensitive files, execute arbitrary commands, or establish persistent access to the compromised WordPress installation.
From an operational impact perspective, this vulnerability poses significant risks to WordPress installations using the affected ElementsKit plugin. Attackers can leverage this flaw to execute any PHP code present in files that can be uploaded to the system, which may include images or other seemingly harmless file types that are processed by the plugin. The ability to bypass access controls means that an attacker could potentially escalate privileges beyond their initial contributor-level access, gaining access to sensitive data, user information, or administrative functions. This vulnerability can be particularly dangerous in multi-user environments where contributors may have access to content but not administrative privileges, as the flaw allows them to circumvent these security boundaries. The exploitation of this vulnerability can result in complete system compromise, data exfiltration, or the establishment of backdoors for continued access.
Organizations and WordPress administrators should immediately address this vulnerability by updating to the latest version of the ElementsKit plugin where the issue has been resolved. The recommended mitigation strategy involves implementing the most recent plugin version that contains patched code for the render_raw function, ensuring that all input parameters are properly validated and sanitized before processing. Additionally, administrators should consider implementing additional security measures such as restricting file upload capabilities, monitoring for suspicious file inclusion patterns, and enforcing the principle of least privilege for user accounts. The vulnerability also highlights the importance of regular security audits and updates, as well as the necessity of following security best practices in plugin development, including proper input validation, secure coding practices, and regular vulnerability assessments. Organizations should also monitor their systems for signs of exploitation attempts and maintain comprehensive backup strategies to ensure quick recovery in case of successful attacks.