CVE-2024-2203

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The The Plus Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.4.1 via the Clients widget. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Mar 27, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-220308.0A vulnerability has been identified within Rancher that can be exploited in narrow circumstances through a man-in-the-middle (MITM) attack.CVE-2024-220318.5A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a pro CVE-2024-220326.5A vulnerability has been identified in which an RKE1 cluster keeps constantly reconciling when secrets encryption configuration is enabled.CVE-2024-220336.3The OBS service obs-service-download_url was vulnerable to a command injection vulnerability. The attacker could provide a configuration to CVE-2024-220345.5Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configu CVE-2024-220369.1A vulnerability has been identified within Rancher where a cluster or node driver can be used to escape the chroot jail and gain root acces CVE-2024-220375.5The uyuni-server-attestation systemd service needs a database_password environment variable. This file has 640 permission, and cannot be sho CVE-2024-220387.3Various problems in obs-scm-bridge allows attackers that create specially crafted git repositories to leak information of cause denial of se CVE-2024-220399.8A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions < IP8), Cerberus PRO EN Fire Panel FC72x IP6 (All vers CVE-2024-22045.5Zemana AntiLogger v2.74.204.664 is vulnerable to a Denial of Service (DoS) vulnerability by triggering the 0x80002004 and 0x80002010 IOCTL c CVE-2024-220407.5A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions), Cerberus PRO EN Fire Panel FC72x IP6 (All versions),CVE-2024-220417.5A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions), Cerberus PRO EN Fire Panel FC72x IP6 (All versions),