CVE-2026-1620

VULNERABILITY BRIEFING - CVE-2026-1620 The Livemesh Addons for Elementor WordPress plugin contains a Local File Inclusion vulnerability affecting all versions through 9.0. The flaw stems from insufficient sanitization of the template name parameter in the lae_get_template_part() function, where a basic str_replace() filter can be bypassed using recursive directory traversal patterns, enabling authenticated attackers with Contributor-level access to include and execute arbitrary files on the server. This vulnerability carries a CVSS score of 8.8 (HIGH) with a network-based attack vector requiring only low privileges and no user interaction. The impact is severe, permitting attackers to achieve high-level confidentiality, integrity, and availability breaches. Exploitation requires prior authentication and either administrative action or successful plugin installation, somewhat limiting the immediate attack surface. Current exploitation status indicates minimal active threat activity. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog, and EPSS scoring of 0.00084 places it below the 0.24% baseline, suggesting low real-world exploitation likelihood. No public proof-of-concept code appears widely available, and the issue has not generated significant community attention, though the moderate FAUCET risk score of 42.0 warrants monitoring for future developments.