The Elementor plugin for WordPress contains a file name validation flaw in the Import_Images::import() method, allowing an authenticated user with administrator privileges or higher to read the contents of arbitrary files on the server. This flaw falls under CWE-22 and can lead to the disclosure of sensitive data such as configuration files, credentials, or any files accessible to the web application. The risk is limited to confidentiality exposure; the flaw does not directly provide code execution or denial of service.

All installations of Elementor version 3.30.2 or earlier on any WordPress site, including both free and commercial deployments of the Elementor Website Builder plugin. The vulnerability affects the entire plugin and not any specific sub‑components beyond the image import functionality.

The CVSS score of 4.9 categorizes the vulnerability as moderate, and the EPSS score of less than 1% indicates a low current exploitation probability. The flaw is not listed in the CISA KEV catalog. Exploitation requires that the attacker already has administrator-level access on the WordPress site. No additional network access is needed beyond what an authenticated administrator possesses. The attack vector is therefore internal to the WordPress environment and is most likely to be abused by compromised or malicious administrative accounts.