The Plus Addons for Elementor <= 6.5.1 - Authenticated (Contributor+) Local File Inclusion via Blog Widget 'post_category_style' Setting
- ID
- WPSEC-2026-0267
- Plugin
- The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates (the-plus-addons-for-elementor-page-builder)
- Affected
- from 6.4.0 before 6.5.2
- Remediation
- Update to 6.5.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-98
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- The Plus Addons for Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The The Plus Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.5.1 via the post category style setting of the blog widget (blog style 5). This is due to the saved control value being concatenated into an include() statement without validation or sanitization, allowing ../ path traversal sequences. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, which can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be placed on the server.
References
- https://wpsec.com/vuln/WPSEC-2026-0267/
- https://plugins.svn.wordpress.org/the-plus-addons-for-elementor-page-builder/tags/6.5.2/
- https://wordpress.org/plugins/the-plus-addons-for-elementor-page-builder/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS