CVE-2024-2047: Elements Kit Elementor Addons RCE Vulnerability

CVE-2024-2047 Overview

The ElementsKit Elementor addons plugin for WordPress contains a Local File Inclusion (LFI) vulnerability affecting all versions up to and including 3.0.6. The flaw resides in the render_raw function within the plugin's testimonial widget. Authenticated attackers with contributor-level access or above can include and execute arbitrary files on the server. This allows execution of any PHP code contained in those files, enabling attackers to bypass access controls, read sensitive data, or achieve remote code execution when combined with file upload primitives such as image uploads.

Critical Impact
Authenticated contributors can achieve arbitrary PHP code execution on the underlying WordPress server through file inclusion, leading to full site compromise.

Affected Products

Wpmet ElementsKit Elementor Addons (elementskit-lite) versions up to and including 3.0.6
WordPress installations using the elementskit-lite plugin testimonial widget
All WordPress sites where users hold contributor role or higher

Discovery Timeline

2024-03-30 - CVE-2024-2047 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2047

Vulnerability Analysis

The vulnerability is classified under [CWE-98] (Improper Control of Filename for Include/Require Statement in PHP Program). It exists in the render_raw function of the testimonial widget located at widgets/testimonial/testimonial.php. The function accepts user-controlled input and passes it to a PHP include-style operation without adequate path validation or allowlisting. Because Elementor widget settings can be manipulated by users with contributor privileges, low-privileged authenticated users can direct the plugin to include arbitrary local files. Any included file is parsed and executed as PHP, transforming a file read primitive into arbitrary code execution.

Root Cause

The root cause is the absence of proper sanitization and path restriction on the template parameter consumed by render_raw. The function trusts contributor-supplied widget data and resolves it into a filesystem path used in a PHP include or require call. There is no allowlist restricting inclusion to plugin-controlled template directories, and traversal sequences are not stripped. The fix in version 3.0.7 restricts the resolved path to expected template locations, as reflected in the plugin changeset for testimonial.php.

Attack Vector

Exploitation requires an authenticated session at contributor privilege or higher. The attacker creates or edits an Elementor page, inserts the ElementsKit testimonial widget, and manipulates the widget's template parameter to reference an arbitrary file path. When the page is rendered, render_raw includes the specified file and executes any embedded PHP. Attackers commonly chain this with a media upload that embeds PHP inside an image file to achieve full remote code execution. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Code Reference for the vulnerable code location.

Detection Methods for CVE-2024-2047

Indicators of Compromise

Unexpected PHP files or webshells appearing under wp-content/uploads/ or plugin directories after contributor activity
HTTP requests to admin-ajax.php invoking ElementsKit widget rendering with path traversal sequences such as ../ in template parameters
New or modified WordPress administrator accounts created shortly after contributor logins
Outbound network connections from the PHP-FPM or web server process to unfamiliar hosts

Detection Strategies

Monitor Elementor widget save events for testimonial widget payloads containing filesystem paths, traversal sequences, or references outside plugin template directories
Inspect web server logs for POST requests to Elementor AJAX endpoints originating from contributor-role accounts followed by anomalous PHP execution
Audit installed plugin versions across WordPress fleets and flag any elementskit-lite installation at version 3.0.6 or earlier

Monitoring Recommendations

Enable file integrity monitoring on wp-content/plugins/ and wp-content/uploads/ directories to identify unauthorized PHP files
Log and alert on new contributor account creation and privilege escalation events within WordPress
Forward WordPress audit logs and web server access logs to a centralized data lake for correlation of contributor activity with file inclusion patterns

How to Mitigate CVE-2024-2047

Immediate Actions Required

Update the ElementsKit Elementor Addons plugin to version 3.0.7 or later on all WordPress installations
Audit all contributor, author, and editor accounts and remove or disable those that are unused or unverified
Review recent uploads and plugin directories for suspicious PHP files and remove any confirmed webshells
Rotate WordPress secret keys in wp-config.php and reset passwords for privileged accounts if compromise is suspected

Patch Information

The vendor released the fix in elementskit-lite version 3.0.7. The corrective changes to widgets/testimonial/testimonial.php are documented in the WordPress Plugin Changeset Log. Administrators should apply the update through the WordPress plugin manager or by deploying the updated package via configuration management.

Workarounds

Deactivate the ElementsKit Elementor Addons plugin until version 3.0.7 or later can be installed
Restrict contributor and author role assignments to trusted users and require multi-factor authentication for all authenticated WordPress accounts
Deploy a web application firewall rule to block requests containing path traversal patterns targeting Elementor AJAX endpoints
Configure PHP open_basedir to restrict file inclusion to the WordPress installation directory tree

bash

# Configuration example: verify plugin version and disable if vulnerable
wp plugin get elementskit-lite --field=version
wp plugin deactivate elementskit-lite
wp plugin update elementskit-lite --version=3.0.7