CVE-2024-2385: Livemesh Elementor Addons RCE Vulnerability

CVE-2024-2385 Overview

The Elementor Addons by Livemesh plugin for WordPress contains a Local File Inclusion (LFI) vulnerability affecting all versions up to and including 8.4. The flaw resides in several plugin widgets that process the style attribute without proper validation. Authenticated attackers with contributor-level access or above can include and execute arbitrary files on the server. Successful exploitation allows execution of any PHP code contained within included files. Attackers can leverage this to bypass access controls, read sensitive server files, or achieve remote code execution when combined with file upload primitives such as image uploads. CVE-2024-37547 is likely a duplicate of this issue.

Critical Impact
Contributor-level attackers can achieve arbitrary PHP code execution on affected WordPress sites by abusing the style attribute in vulnerable Livemesh widgets.

Affected Products

Livemesh Addons for Elementor plugin for WordPress, all versions through 8.4
WordPress installations using the vulnerable widgets (including the Heading widget)
Sites where contributor-or-higher accounts can be registered or compromised

Discovery Timeline

2024-07-04 - CVE-2024-2385 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2385

Vulnerability Analysis

The vulnerability is a Local File Inclusion flaw categorized under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory). The plugin passes user-controllable values from the style attribute of several Elementor widgets into helper functions that resolve and include PHP template files. Because the plugin fails to restrict the resolved path to an allowlist of expected template files, attackers can traverse the filesystem and cause arbitrary local PHP files to be included and executed within the WordPress process.

The issue is reachable by any authenticated user who can edit posts through the Elementor editor. WordPress contributors qualify, making the barrier to exploitation low on sites that permit contributor registration. The vulnerable code paths reside in includes/helper-functions.php and widget files such as includes/widgets/heading.php.

Root Cause

The root cause is missing input validation on the style parameter used to construct include paths. The plugin concatenates the attacker-supplied style value into a filesystem path and passes it to a PHP include operation without verifying that the resolved file belongs to the plugin's template directory. This design allows path traversal sequences to escape the intended directory.

Attack Vector

Exploitation follows a network-based attack path. An attacker authenticates with contributor-level credentials, creates or edits an Elementor page, and inserts a vulnerable Livemesh widget with a crafted style attribute. When the page is rendered, the plugin includes the attacker-specified file and executes any PHP it contains. Combined with WordPress media upload capabilities, attackers can upload a polyglot image containing PHP and include it to achieve remote code execution.

No verified public exploit code is available for this CVE. See the Wordfence Vulnerability Report and the WordPress Elementor Heading Widget source for technical details.

Detection Methods for CVE-2024-2385

Indicators of Compromise

Web server access logs containing Elementor render requests with style parameter values containing ../ sequences or absolute filesystem paths
Unexpected PHP files under wp-content/uploads/ that were referenced immediately after being uploaded by contributor accounts
New or modified WordPress administrator accounts created shortly after contributor-authored Elementor page edits
Outbound network connections from the PHP worker process to attacker-controlled infrastructure following widget rendering

Detection Strategies

Inspect POST requests to admin-ajax.php and Elementor preview endpoints for widget payloads containing directory traversal patterns in the style field
Correlate contributor-level authentication events with subsequent creation of pages using Livemesh widgets and monitor for anomalous file access from php-fpm or apache2 processes
Audit installed versions of the addons-for-elementor plugin across managed WordPress instances and flag any version at or below 8.4

Monitoring Recommendations

Enable file integrity monitoring on the WordPress webroot, particularly wp-content/plugins/addons-for-elementor/ and wp-content/uploads/
Forward WordPress audit logs, PHP error logs, and web access logs to a centralized SIEM for correlation across user activity and file inclusion patterns
Alert on any contributor or author account that publishes or previews pages containing Livemesh widget markup with suspicious attribute values

How to Mitigate CVE-2024-2385

Immediate Actions Required

Update the Livemesh Addons for Elementor plugin to a version later than 8.4 that addresses the LFI, as tracked in the WordPress Elementor Changeset
Audit all contributor, author, and editor accounts and remove or reset any that are unrecognized or dormant
Review recently published or draft pages for Livemesh widgets containing unusual style attribute values and remove suspicious content
Scan wp-content/uploads/ for PHP files or polyglot images and remove any unauthorized artifacts

Patch Information

The vendor addressed the vulnerability in a release following version 8.4. The corrective changeset restricts the values accepted by the style attribute so that user-supplied input can no longer resolve to arbitrary filesystem paths. Site owners should upgrade to the latest available version of the plugin through the WordPress plugin dashboard or WP-CLI.

Workarounds

Restrict contributor-and-above registration on public sites and require administrator approval for new author accounts
Deploy a web application firewall rule that blocks requests with directory traversal sequences in Elementor widget parameters
Temporarily deactivate the Livemesh Addons for Elementor plugin until the update is applied on sites where contributor accounts cannot be tightly controlled
Configure PHP open_basedir to constrain file inclusion to the WordPress installation directory

bash

# Update the plugin via WP-CLI
wp plugin update addons-for-elementor

# Verify the installed version is above 8.4
wp plugin get addons-for-elementor --field=version

# Temporarily deactivate the plugin if a patch cannot be applied immediately
wp plugin deactivate addons-for-elementor