ElementInvader Addons for Elementor Local File Inclusion Vulnerability

A path traversal vulnerability allowing PHP local file inclusion has been identified in the ElementInvader Addons for Elementor plugin, affecting versions through 1.2.6. This vulnerability could enable a malicious actor to include local files from the target website and display their contents, potentially leading to a complete database takeover if sensitive files containing database credentials are accessed.

Impact

Exploitation of this vulnerability could allow for local file inclusion, enabling the inclusion of sensitive files from the server, such as those containing database credentials, which could lead to a complete takeover of the database, depending on the configuration.

Remediation

Users of the ElementInvader Addons for Elementor plugin should update to version 1.2.7 or later to address this vulnerability. Patchstack users can enable auto-update for vulnerable plugins.