A path traversal flaw in the Element Invader Addons for Elementor plugin allows an attacker to include arbitrary local files by manipulating the file path parameter, potentially exposing sensitive data or executing PHP code. The vulnerability is classified as CWE‑22 (Path Traversal) and CWE‑35 (Improper Handling of Relative Path).

WordPress sites that have installed the Element Invader Addons for Elementor plugin, specifically versions up to and including 1.2.6. No other product versions are mentioned as affected.

The CVSS score of 7.5 denotes high severity, while a very low EPSS score (<1%) suggests that active exploitation is unlikely at present; the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the most probable attack vector involves a remote attacker submitting a crafted request to the plugin’s endpoint over the web, exploiting the path traversal to trigger a PHP Local File Inclusion that could read files or execute code.