The Ultimate Bootstrap Elements for Elementor plugin contains an improper check of filenames used in PHP include/require statements, which is a CWE‑98 flaw. This vulnerability enables an attacker who can manipulate plugin input to specify an arbitrary local file, causing the PHP interpreter to include that file. If the included file contains PHP code or is executed in a context that interprets PHP, the attacker could gain the ability to run malicious code on the server. In the absence of file permission restrictions, the plugin may also expose sensitive configuration files or other data that belong to the site.

WordPress installations that have the Ultimate Bootstrap Elements for Elementor plugin installed with any release from its inception up to and including version 1.4.9 are affected. No update or patch version is specified in the data, but the flaw applies to all these releases.

The CVSS score of 8.1 marks the vulnerability as high severity, while an EPSS score of 0.0176% indicates that exploitation in the wild is extremely unlikely. The flaw is listed as not present in the CISA KEV catalog, so it has not yet been reported as a widely exploited vulnerability. Exploitation would typically involve sending a crafted request that supplies a path to an arbitrary local file; this can be achieved via plugin settings, query parameters, or other input points that the plugin passes to the include/require call.