CVE-2024-1358 – The Elementor Addon Elements WordPress plugin h... (How to Fix)

Q: What is the severity of CVE-2024-1358?

CVE-2024-1358 has a CVSS score of 8.8 (HIGH). The Elementor Addon Elements WordPress plugin has a directory traversal vulnerability in its render function. Authenticated attackers with contributor-level access or higher can exploit this to read arbitrary PHP files on the server, potentially exposing sensitive information like configuration files or credentials. This affects all versions up to and including 1.12.12.

📋 TL;DR

The Elementor Addon Elements WordPress plugin has a directory traversal vulnerability in its render function. Authenticated attackers with contributor-level access or higher can exploit this to read arbitrary PHP files on the server, potentially exposing sensitive information like configuration files or credentials. This affects all versions up to and including 1.12.12.

💻 Affected Systems

Products:

Elementor Addon Elements for WordPress

Versions: All versions up to and including 1.12.12

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires authenticated user with at least contributor-level permissions. WordPress multisite installations are also affected.

📦 What is this software?

Elementor Addon Elements by Webtechstreet

View all CVEs affecting Elementor Addon Elements →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could read sensitive files like wp-config.php containing database credentials, leading to full site compromise, data theft, or server takeover.

🟠

Likely Case

Attackers with contributor access read configuration files to obtain database credentials, then escalate privileges or exfiltrate sensitive data.

🟢

If Mitigated

With proper access controls and file permissions, impact is limited to reading non-sensitive PHP files or triggering errors.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires contributor-level access. Public proof-of-concept code is available in vulnerability reports.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.12.13 and later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3037925/addon-elements-for-elementor-page-builder/trunk/modules/shape-separator/widgets/shape-separator.php

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Addon Elements for Elementor'. 4. Click 'Update Now' if update is available. 5. Alternatively, download version 1.12.13+ from WordPress.org and manually update.

🔧 Temporary Workarounds

Disable vulnerable plugin

all

Temporarily deactivate the Addon Elements plugin until patched

wp plugin deactivate addon-elements-for-elementor-page-builder

Restrict contributor access

all

Temporarily remove contributor role permissions or limit contributor accounts

🧯 If You Can't Patch

Implement strict file permissions (e.g., 600 for sensitive files like wp-config.php)
Add web application firewall rules to block directory traversal patterns

🔍 How to Verify

Check if Vulnerable:

Check plugin version in WordPress admin under Plugins → Installed Plugins. If version is 1.12.12 or lower, you are vulnerable.

Check Version:

wp plugin get addon-elements-for-elementor-page-builder --field=version

Verify Fix Applied:

After updating, verify plugin version shows 1.12.13 or higher in WordPress admin.

📡 Detection & Monitoring

Log Indicators:

Unusual file access patterns in web server logs, especially requests containing '../' sequences to PHP files
Multiple failed attempts to access sensitive files from contributor-level accounts

Network Indicators:

HTTP requests with directory traversal payloads (e.g., '../../wp-config.php') to the shape separator endpoint

SIEM Query:

source="web_logs" AND (uri="*../*" OR uri="*..%2f*") AND uri="*.php" AND user_agent="*WordPress*"

📊 Metadata

CVE ID: CVE-2024-1358

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-22

Published: March 13, 2024

Last Updated: January 17, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-1358, you might also want to check these: