CVE-2024-13353: Responsive Addons Elementor RCE Flaw

CVE-2024-13353 Overview

CVE-2024-13353 is a Local File Inclusion (LFI) vulnerability in the Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress. The flaw affects all versions up to and including 1.6.4 and stems from unsafe handling of user-controlled input in several plugin widgets. Authenticated attackers with Contributor-level access or above can include and execute arbitrary files on the server, leading to PHP code execution. Attackers can leverage the flaw to bypass access controls, read sensitive files, or achieve remote code execution when combined with uploads of image or other seemingly safe file types.

Critical Impact
Authenticated Contributor-level users can execute arbitrary PHP code on the underlying WordPress server, resulting in full site compromise.

Affected Products

Cyberchimps Responsive Addons for Elementor plugin for WordPress, versions <= 1.6.4
Vulnerable widget: class-responsive-addons-for-elementor-product-carousel.php
Vulnerable widget: class-responsive-addons-for-elementor-woo-products.php

Discovery Timeline

2025-02-21 - CVE-2024-13353 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13353

Vulnerability Analysis

The vulnerability is a Local File Inclusion issue [CWE-98, CWE-829] in the WooCommerce-oriented widgets shipped by the Responsive Addons for Elementor plugin. Widget rendering paths accept attacker-influenced template or file parameters and pass them to PHP file inclusion functions without adequate validation or allowlisting. Any authenticated user with Contributor privileges or higher can inject a path that traverses the WordPress installation and includes an arbitrary local file. When that file contains PHP, the interpreter executes it in the context of the web server user, granting code execution on the host.

Root Cause

The root cause is improper control of a filename passed to a PHP include or require statement inside widget templates such as those in class-responsive-addons-for-elementor-product-carousel.php and class-responsive-addons-for-elementor-woo-products.php. The affected widgets do not restrict inclusion targets to a fixed allowlist of template files, allowing arbitrary path values from widget settings to reach the inclusion sink.

Attack Vector

An attacker must first authenticate to WordPress with Contributor-level access or higher. From an editable post or page, the attacker configures a vulnerable widget with a crafted template value referencing an arbitrary local file. When the widget is rendered, PHP includes and executes that file. Combined with WordPress media uploads or other writable locations that accept image formats containing embedded PHP, this results in remote code execution over the network.

No verified proof-of-concept code is publicly available. Refer to the Wordfence Vulnerability Report and the WordPress Widget Code Review for the vulnerable code paths.

Detection Methods for CVE-2024-13353

Indicators of Compromise

Unexpected PHP files or webshells appearing under wp-content/uploads/ following Contributor or Author activity.
Web server access logs showing widget rendering requests with path traversal sequences such as ../ in widget configuration parameters.
New or modified posts authored by low-privilege users that reference the Responsive Addons product carousel or Woo products widgets.

Detection Strategies

Inspect the plugin version reported by WordPress; any deployment of Responsive Addons for Elementor at or below 1.6.4 is vulnerable.
Review saved post and page meta for widget settings that contain filesystem paths, ../ sequences, or references to files outside the plugin templates directory.
Correlate Contributor and Author account activity with subsequent PHP process creation from the web server user, which is anomalous for those roles.

Monitoring Recommendations

Enable WordPress audit logging for post creation, revision, and widget updates initiated by non-Administrator roles.
Monitor file integrity across wp-content/uploads/ and the plugin directory for new PHP files or unexpected changes.
Alert on outbound network connections initiated by the PHP-FPM or Apache worker process shortly after page rendering events tied to the vulnerable widgets.

How to Mitigate CVE-2024-13353

Immediate Actions Required

Upgrade Responsive Addons for Elementor to version 1.6.5 or later on every WordPress site running the plugin.
Audit all Contributor, Author, and Editor accounts and remove any that are unused, inactive, or unrecognized.
Review recent posts and pages that use the Product Carousel or Woo Products widgets and remove any suspicious widget configurations.

Patch Information

The vendor addressed the vulnerability in version 1.6.5. The fix is documented in the WordPress plugin repository changesets for class-responsive-addons-for-elementor-product-carousel.php and class-responsive-addons-for-elementor-woo-products.php. Administrators should apply the update immediately through the WordPress plugin manager or WP-CLI.

Workarounds

If patching cannot occur immediately, deactivate the Responsive Addons for Elementor plugin until version 1.6.5 or later is applied.
Restrict who can create or edit posts by removing Contributor and Author privileges from untrusted accounts.
Deploy a web application firewall rule that blocks path traversal patterns and PHP wrappers in POST parameters targeting admin-ajax.php and Elementor editor endpoints.

bash

# Upgrade the plugin via WP-CLI to the patched version
wp plugin update responsive-addons-for-elementor --version=1.6.5

# Verify the installed version
wp plugin get responsive-addons-for-elementor --field=version

# Temporary mitigation: deactivate the plugin if patching is delayed
wp plugin deactivate responsive-addons-for-elementor