CVE-2024-50453 in The Pack Elementor Addons Plugin
Summary
by MITRE • 10/28/2024
Relative Path Traversal vulnerability in webangon The Pack Elementor addons the-pack-addon allows PHP Local File Inclusion.This issue affects The Pack Elementor addons: from n/a through <= 2.0.9.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/06/2026
The vulnerability identified as CVE-2024-50453 represents a critical relative path traversal flaw within the webangon The Pack Elementor addons plugin, specifically affecting versions up to and including 2.0.9. This issue manifests as a PHP local file inclusion vulnerability that stems from inadequate input validation and improper handling of file paths within the plugin's functionality. The flaw allows attackers to manipulate file path parameters to access arbitrary files on the server filesystem, potentially leading to unauthorized data access, system compromise, or further exploitation of the affected environment.
The technical implementation of this vulnerability occurs when the plugin processes user-supplied input without proper sanitization or validation, enabling attackers to craft malicious requests that traverse directory structures. This weakness directly maps to CWE-22, which describes improper limitation of a pathname to a restricted directory, commonly known as path traversal or directory traversal attacks. The vulnerability is particularly dangerous because it leverages the Elementor plugin architecture, which typically runs with elevated privileges on WordPress installations, potentially allowing attackers to access sensitive configuration files, user credentials, or other critical system resources.
From an operational impact perspective, this vulnerability poses significant risks to WordPress sites utilizing the affected plugin version. Attackers can exploit the flaw to read arbitrary files, potentially accessing database credentials, plugin configurations, or even administrative files that could lead to complete system compromise. The vulnerability's severity is amplified by the widespread adoption of Elementor and The Pack addons, making numerous websites susceptible to exploitation. According to ATT&CK framework, this vulnerability aligns with T1059.007 (Scripting) and T1566.001 (Phishing with Malicious Attachment) attack techniques, as it enables attackers to execute malicious code or extract sensitive information through compromised plugin functionality.
Mitigation strategies should prioritize immediate remediation through plugin updates to versions that address the path traversal vulnerability. System administrators should implement web application firewalls with rules specifically designed to detect and block path traversal attempts, particularly targeting the plugin's endpoints. Additionally, implementing proper input validation, output encoding, and least privilege principles for file access operations can significantly reduce the attack surface. Regular security audits and penetration testing should be conducted to identify similar vulnerabilities in other plugins or custom code components, while maintaining updated security patches for the entire WordPress ecosystem including themes, plugins, and core software. Organizations should also consider implementing monitoring solutions that can detect anomalous file access patterns or suspicious parameter values that may indicate exploitation attempts.