The Easy Elementor Addons plugin for WordPress contains a critical local file inclusion vulnerability that permits authenticated attackers to compromise server integrity.

This vulnerability, classified as CWE-98, stems from the improper handling of filenames used in include or require statements. An authenticated user with low-level privileges can manipulate these inputs to perform local file inclusion, potentially leading to unauthorized data access or code execution.

The ability to perform local file inclusion poses a severe risk to the confidentiality, integrity, and availability of the host system. With a CVSS score of 7.5, this flaw could allow an attacker to read sensitive configuration files or execute malicious PHP code, potentially leading to a full system compromise and significant reputational damage.

Immediate Action: Review the official Patchstack vendor advisory for the release of a security update and apply it immediately to all affected WordPress installations. If no update is available, consider disabling or removing the plugin until a secure version is released.

Proactive Monitoring: Monitor server access logs for suspicious requests containing directory traversal patterns or unusual file inclusions directed at the plugin directory.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block malicious requests targeting known file inclusion attack patterns before they reach the application.

Public Exploit Available: Unknown.

Given the high CVSS score and the nature of local file inclusion vulnerabilities, organizations must treat this issue with urgency. Administrators should verify their current version of Easy Elementor Addons and prioritize the application of any provided vendor patches to prevent unauthorized access and potential remote code execution.