CVE-2024-4359

CVE-2024-4359 is an arbitrary file read vulnerability affecting the Element Pack Elementor Addons plugin for WordPress, specifically in versions up to and including 5.7.2. This flaw, located in the SVG widget's render_svg function due to insufficient file validation, allows authenticated attackers with contributor-level access or higher to read sensitive files on the server. The vulnerability carries a CVSS score of 6.5 (Medium), indicating a network-based attack with low complexity and requiring low privileges, but with a high impact on confidentiality. While the EPSS score is low, suggesting a lower likelihood of exploitation, the potential for sensitive data exposure is significant. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The vulnerability has also received minimal community discussion and media coverage, suggesting a low profile at present.