The Livemesh Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion because the template name parameter in the lae_get_template_part() function is not properly sanitized. This flaw allows authenticated users with Contributor or higher roles to supply a recursive directory traversal string that bypasses the naive str_replace sanitization. An attacker can therefore include and execute arbitrary files located on the web server, potentially reading sensitive data or running PHP code that leads to system compromise.

All releases of the Livemesh Addons by Elementor plugin up to and including version 9.0 are affected. No further version granularity is available from the vendor information.

The vulnerability poses a significant risk because it enables an authenticated contributor or higher role to gain filesystem access and possibly execute arbitrary code on the server. The high CVSS score of 8.8 signals strong potential impact. Although EPSS data is not available, the attack could proceed using the widget's template parameter to trigger a directory traversal, leading to sensitive file disclosure or code execution and possible full site compromise.