Responsive Addons for Elementor Local File Inclusion Vulnerability

A local file inclusion vulnerability has been identified in the Responsive Addons for Elementor - Free Elementor Addons Plugin and Elementor Templates, affecting all versions through 1.6.4. The vulnerability allows authenticated attackers with Contributor-level access and above to include and execute arbitrary files on the server. This exploitation could be used to bypass access controls, access sensitive information, or execute code in cases where 'safe' file types like images can be uploaded and included.

Impact

Exploitation of this vulnerability could lead to unauthorized file inclusion, allowing for the execution of arbitrary PHP code on the server. This could be used to bypass access controls, access sensitive data, or execute malicious code, especially in scenarios where 'safe' file types can be uploaded and included.

Reproduction

The vulnerability can be reproduced by an authenticated user with Contributor-level access or higher. Several widgets in the Responsive Addons for Elementor plugin can be used to exploit this vulnerability. Once the vulnerability is triggered, the attacker can include and execute arbitrary files on the server.

Remediation

Users are advised to update the Responsive Addons for Elementor plugin to version 1.6.5 or later.