Login Sign Up

CVE-2024-2385

8.8 HIGH
Remote Code Execution

📋 TL;DR

This vulnerability allows authenticated attackers with contributor-level access or higher to perform Local File Inclusion via the 'style' attribute in several widgets of the Elementor Addons by Livemesh plugin. This enables execution of arbitrary PHP code on the server, potentially leading to data theft, access control bypass, or full system compromise. All WordPress sites using vulnerable versions of this plugin are affected.

💻 Affected Systems

Products:
  • Elementor Addons by Livemesh WordPress plugin
Versions: All versions up to and including 8.3.7
Operating Systems: Any OS running WordPress
Default Config Vulnerable: ⚠️ Yes
Notes: Requires contributor-level or higher authenticated access. The plugin must be active and widgets with vulnerable 'style' attributes must be in use.

📦 What is this software?

Addons For Elementor by Livemeshelementor

View all CVEs affecting Addons For Elementor →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full server compromise leading to data exfiltration, ransomware deployment, or complete site takeover through arbitrary code execution.

🟠

Likely Case

Unauthorized file access leading to sensitive data exposure, privilege escalation, or backdoor installation.

🟢

If Mitigated

Limited impact if proper file upload restrictions and server hardening are in place, though file inclusion may still expose sensitive information.

🌐 Internet-Facing: HIGH
🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: LIKELY
Unauthenticated Exploit: ✅ No
Complexity: LOW

Exploitation requires authenticated access but is straightforward once credentials are obtained. Multiple proof-of-concept references exist in public sources.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 8.3.8 or later

Vendor Advisory: https://wordpress.org/plugins/addons-for-elementor/#developers

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Elementor Addons by Livemesh'. 4. Click 'Update Now' if available. 5. Alternatively, download version 8.3.8+ from WordPress.org and manually update.

🔧 Temporary Workarounds

Disable vulnerable plugin

all

Temporarily deactivate the Elementor Addons by Livemesh plugin until patched

wp plugin deactivate addons-for-elementor

Restrict contributor access

all

Temporarily remove contributor-level access for untrusted users

🧯 If You Can't Patch

  • Implement strict file upload restrictions and disable PHP execution in upload directories
  • Deploy web application firewall rules to block local file inclusion patterns

🔍 How to Verify

Check if Vulnerable:

Check plugin version in WordPress admin under Plugins → Installed Plugins. If Elementor Addons by Livemesh version is 8.3.7 or lower, you are vulnerable.

Check Version:

wp plugin get addons-for-elementor --field=version

Verify Fix Applied:

Verify plugin version is 8.3.8 or higher after update. Test that widgets with 'style' attributes no longer accept file paths.

📡 Detection & Monitoring

Log Indicators:

  • Unusual file path patterns in POST requests to /wp-admin/admin-ajax.php
  • Multiple failed authentication attempts followed by successful contributor login
  • PHP file inclusion attempts in widget parameter logs

Network Indicators:

  • POST requests containing file paths in 'style' parameters
  • Unusual outbound connections from web server after successful exploitation

SIEM Query:

source="web_logs" AND (uri_path="/wp-admin/admin-ajax.php" AND (param="style" CONTAINS "../" OR param="style" CONTAINS "/etc/" OR param="style" CONTAINS "/proc/"))

📊 Metadata

CVE ID: CVE-2024-2385
CVSS v3 Score: 8.8 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: July 4, 2024
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON