A Local File Inclusion vulnerability in the Livemesh Addons for Elementor plugin allows authenticated contributors to execute arbitrary local files on the server, posing a high risk to site integrity.

This vulnerability stems from improper control of filenames for include statements (CWE-98). Authenticated attackers with Contributor-level access or higher can bypass inadequate sanitization in the lae_get_template_part function to include and execute arbitrary local files.

The ability for an authenticated user to perform Local File Inclusion (LFI) can lead to full server-side code execution. This allows attackers to compromise sensitive configuration files, steal database credentials, or gain control over the WordPress environment. With a CVSS score of 8.8, this vulnerability represents a significant risk to the confidentiality, integrity, and availability of the hosting infrastructure.

Immediate Action: Since a specific patch version is currently unconfirmed, administrators should disable or uninstall the Livemesh Addons for Elementor plugin until a fix is released by the vendor.

Proactive Monitoring: Monitor server access logs for anomalous file inclusion attempts or unexpected requests directed at the WordPress plugin directory.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block directory traversal patterns and unauthorized file inclusion attempts.

Public Exploit Available: No (exploit_available: unknown)

Given the severity of potential code execution, organizations should prioritize the removal or deactivation of the vulnerable plugin immediately. Security teams must audit user roles to ensure that unauthorized individuals do not possess Contributor-level access, which is required to trigger this flaw. Continue to monitor the vendor advisory for the release of a secure version.