CVE-2024-56282

CVE-2024-56282 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Local File Inclusion (CWE-98), in the Elicus WPMozo Addons Lite for Elementor WordPress plugin (wpmozo-addons-lite-for-elementor). It affects all versions from n/a through 1.1.0, enabling attackers to include arbitrary local files via insufficient validation of user-supplied input in PHP include/require operations.

The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires network access, high attack complexity, and low privileges such as an authenticated user account, with no user interaction needed. Successful exploitation can result in high impacts to confidentiality, integrity, and availability, allowing the inclusion of sensitive local files that may lead to data exposure or further compromise depending on the target's configuration.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wpmozo-addons-lite-for-elementor/vulnerability/wordpress-wpmozo-addons-lite-for-elementor-plugin-1-1-0-local-file-inclusion-vulnerability?_s_id=cve. Security practitioners should update to a patched version if available and review access controls for the plugin.