CVE-2024-2047

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The ElementsKit Elementor addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.6 via the render_raw function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-98

Affected software

No affected versions have been published.

Timeline

Published
Mar 30, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-204707.2A vulnerability in the web-based management interface of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers CVE-2024-204716.5A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticatedCVE-2024-204726.5A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticatedCVE-2024-204736.5A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticatedCVE-2024-204746.5A vulnerability in Internet Key Exchange version 2 (IKEv2) processing of Cisco Secure Client Software could allow an unauthenticated, remoteCVE-2024-204755.4A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenCVE-2024-204764.9A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to bypass the authorizationCVE-2024-204775.4A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to upload or delCVE-2024-204787.2A vulnerability in the software upgrade component of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Network CVE-2024-204794.8A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack agCVE-2024-20489.8Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CCVE-2024-204808.6A vulnerability in the DHCP Snooping feature of Cisco IOS XE Software on Software-Defined Access (SD-Access) fabric edge nodes could allow a
CVE-2024-2047: High severity, CVSS 8.8 | Vulnix