CVE-2023-47178 WordPress The Plus Addons for Elementor Pro plugin <= 5.2.8 - Unauthenticated Local File Inclusion vulnerability

What is CVE-2023-47178?

CVE-2023-47178 is a high-severity path traversal vulnerability in POSIMYTH Innovation The Plus Addons for Elementor Pro, published on 17 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in POSIMYTH Innovation The Plus Addons for Elementor Pro allows PHP Local File Inclusion.This issue affects The Plus Addons for Elementor Pro: from n/a through 5.2.8.

Weakness: CWE-22

Which versions are affected by CVE-2023-47178?

It affects 1 product.

Products include Posimyth the Plus Addons for Elementor.

How do I fix CVE-2023-47178?

No fix has been published for CVE-2023-47178 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2023-47178 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-47178 exists.

Other vulnerabilities in POSIMYTH Innovation The Plus Addons for Elementor Pro

• CVE-2021-24949 The Plus Addons for Elementor Pro < 5.0.7 - Unauthenticated SQL Injection Critical 9.8
• CVE-2021-24175 The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication Bypass Critical 9.8
• CVE-2024-5455 Path traversal in The Plus Addons for Elementor Page Builder Pro High 8.8
• CVE-2021-4331 Privilege escalation in The Plus Addons for Elementor Page Builder Pro High 8.8
• CVE-2021-24948 The Plus Addons for Elementor Pro < 5.0.7 - Sensitive Data Disclosure High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-536g-7m64-v9jp.