Qi Addons For Elementor, CVE-2024-4887

CVE, Research URL: CVE-2024-4887
Home page URL: Security reports for Qi Addons For Elementor
Application: Qi Addons For Elementor
Published on: Jun 07, 2024
Research Description: The Qi Addons For Elementor plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 1.7.2 via the 'behavior' attributes found in the qi_addons_for_elementor_blog_list shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include remote files on the server, resulting in code execution. Please note that this requires an attacker to create a non-existent directory or target an instance where file_exists won't return false with a non-existent directory in the path, in order to successfully exploit.
Affected versions: Min -, max 1.7.3.
Status: vulnerable