The flaw is improper control of filenames used in PHP include/require statements, allowing a local file inclusion vulnerability in the Devnex Addons For Elementor plugin. This weakness, identified as CWE‑98, could enable an attacker to read arbitrary files on the server and, if a remote file is included, to potentially execute code. The CVE data does not confirm remote code execution or full system compromise.

The vulnerability affects the Devnex Addons For Elementor plugin for WordPress, with all released versions up to and including 1.0.9. No other WordPress plugins or core components are affected.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1 % suggests a low likelihood of exploitation in the wild. The plugin is not listed in the CISA KEV catalog. Based on the description, the most likely attack vector involves manipulating a request parameter that is passed to the plugin’s include/require call, enabling a local file inclusion path. This could allow an attacker to read files or, with further steps, include external code that might be executed.