CVE-2024-5147
Assigner: Wordfence
Published: 2024-05-22T07:37:25.726Z
State: PUBLISHED
affected: vendor: wpzoom
product: WPZOOM Addons for Elementor (Templates, Widgets)
versions: version: *
status: affected
lessThanOrEqual: 1.1.37
versionType: semver
defaultStatus: unaffected
descriptions: value: The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.37 via the 'grid_style' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
title: WPZOOM Addons for Elementor (Templates, Widgets) <= 1.1.37 - Unauthenticated Local File Inclusion
problemTypes: descriptions: description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 9.8
baseSeverity: CRITICAL
credits: type: finder
value: Craig Smith
timeline: time: 2024-05-21T00:00:00.000+00:00
value: Disclosed