The Easy Elementor Addons plugin from hashthemes contains an improper validation of file names used in PHP include/require statements. The flaw allows an attacker to supply a crafted path that points to arbitrary local files on the web server. By including a file that contains PHP code, the attacker can execute that code with the privileges of the web server process, or by including a plaintext configuration file they can obtain sensitive data. The weakness is a classic Local File Inclusion (CWE‑98) vulnerability.

WordPress sites that have the Easy Elementor Addons plugin installed, any version up to and including 2.2.8. The issue applies to all releases from the earliest supported version through 2.2.8.

The vulnerability carries a CVSS score of 7.5, indicating high severity. The EPSS score is less than 1 %, suggesting that exploitation is currently rare but technically feasible. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to craft a request that triggers the vulnerable include logic, typically through the plugin’s exposed functionality or a crafted URL. Once a valid local file is included, the attacker can read protected data or execute arbitrary PHP if the file contains code.