The aThemes Addons for Elementor plugin contains a Local File Inclusion flaw caused by improper control of filenames used in PHP include/require statements. Exploitation could allow an attacker to read sensitive files on the server and, under the right conditions, execute arbitrary code. The vulnerability is tied to CWE-98 and is present in all releases from the initial version up to and including 1.1.3, with no indication that it has been addressed in older releases.

This weakness affects WordPress sites that use the free aThemes Addons for Elementor plugin, published by Syed Balkhi, in any version numbered 1.1.3 or older.

The CVSS score of 7.5 classifies the issue as high severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation has been documented yet. Potential attackers could trigger the flaw by manipulating query parameters or other input fields that influence the filename passed to include or require, thereby enabling local file inclusion and possibly remote code execution. The attack is likely limited to local files on the server and requires the plugin to be active on the target WordPress installation.