CVE-2024-13353 – This vulnerability allows authenticated attacke... (How to Fix)

Q: What is the severity of CVE-2024-13353?

CVE-2024-13353 has a CVSS score of 8.8 (HIGH). This vulnerability allows authenticated attackers with Contributor-level access or higher to perform Local File Inclusion (LFI) in the Responsive Addons for Elementor WordPress plugin. Attackers can include and execute arbitrary PHP files on the server, potentially leading to remote code execution, data theft, or privilege escalation. All WordPress sites using vulnerable versions of this plugin are affected.

📋 TL;DR

This vulnerability allows authenticated attackers with Contributor-level access or higher to perform Local File Inclusion (LFI) in the Responsive Addons for Elementor WordPress plugin. Attackers can include and execute arbitrary PHP files on the server, potentially leading to remote code execution, data theft, or privilege escalation. All WordPress sites using vulnerable versions of this plugin are affected.

💻 Affected Systems

Products:

Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates

Versions: All versions up to and including 1.6.4

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires authenticated user with at least Contributor role. WordPress multisite installations may be affected differently depending on role assignments.

📦 What is this software?

Responsive Addons For Elementor by Cyberchimps

View all CVEs affecting Responsive Addons For Elementor →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full server compromise through remote code execution, allowing attackers to install backdoors, steal sensitive data, deface websites, or pivot to internal networks.

🟠

Likely Case

Unauthorized file access leading to sensitive information disclosure, privilege escalation to administrator, or website defacement.

🟢

If Mitigated

Limited impact if proper file upload restrictions and server hardening are in place, though some information disclosure may still occur.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires authenticated access and knowledge of file paths. Attackers may need to combine with file upload vulnerabilities for full code execution.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.6.5

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3226779/responsive-addons-for-elementor/tags/1.6.5/

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Responsive Addons for Elementor'. 4. Click 'Update Now' if available, or download version 1.6.5+ from WordPress repository. 5. Activate the updated plugin.

🔧 Temporary Workarounds

Temporary Plugin Deactivation

all

Disable the vulnerable plugin until patched

Role Restriction

all

Temporarily restrict Contributor role assignments and review existing Contributor accounts

🧯 If You Can't Patch

Implement strict file upload restrictions to prevent PHP file uploads
Apply web application firewall rules to block LFI patterns and restrict file inclusion paths

🔍 How to Verify

Check if Vulnerable:

Check plugin version in WordPress admin under Plugins → Installed Plugins. Look for 'Responsive Addons for Elementor' version 1.6.4 or lower.

Check Version:

wp plugin list --name='responsive-addons-for-elementor' --field=version

Verify Fix Applied:

Verify plugin version shows 1.6.5 or higher after update. Test file inclusion functionality in affected widgets.

📡 Detection & Monitoring

Log Indicators:

Unusual file inclusion patterns in web server logs, especially with PHP file extensions
Multiple failed file inclusion attempts from Contributor-level accounts
Unexpected PHP file executions in plugin directories

Network Indicators:

HTTP requests with file inclusion parameters targeting plugin widgets
Unusual POST/GET requests to WooCommerce-related plugin endpoints

SIEM Query:

source="web_server" AND (uri="*includes/widgets-manager/widgets/woocommerce/*" AND (param="*file*" OR param="*include*" OR param="*require*"))

📊 Metadata

CVE ID: CVE-2024-13353

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-98

EPSS Score: 0.49% exploit probability (65.1th percentile)

Published: February 21, 2025

Last Updated: February 25, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-13353, you might also want to check these: