CVE-2024-3499 Overview
CVE-2024-3499 is a Local File Inclusion (LFI) vulnerability in the ElementsKit Elementor addons plugin for WordPress. The flaw affects all versions up to and including 3.1.0 and resides in the generate_navigation_markup function of the Onepage Scroll module. Authenticated attackers with contributor-level access or higher can include and execute arbitrary files on the server. Successful exploitation allows attackers to run PHP code, bypass access controls, and access sensitive data. The vulnerability is tracked under [CWE-98] (Improper Control of Filename for Include/Require Statement).
Critical Impact
Authenticated attackers with contributor privileges can execute arbitrary PHP code by including local files, leading to full compromise of the WordPress site.
Affected Products
- Wpmet ElementsKit Elementor Addons plugin versions up to and including 3.1.0
- WordPress sites running the vulnerable elementskit-lite plugin
- Any WordPress deployment allowing contributor-level user registration with ElementsKit enabled
Discovery Timeline
- 2024-05-02 - CVE-2024-3499 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-3499
Vulnerability Analysis
The vulnerability exists in the Onepage Scroll module of the ElementsKit plugin. The generate_navigation_markup function processes user-supplied input without proper validation and passes it to a PHP file inclusion routine. Attackers can manipulate the file path parameter to reference arbitrary files on the underlying server.
Because the inclusion mechanism executes PHP interpretation on the referenced file, any writable path containing attacker-controlled content becomes an execution vector. This includes uploaded images, log files, or other data considered "safe" file types that can be smuggled onto the server.
The attack requires only contributor-level authentication, which is a low bar in multi-author WordPress environments. Once inside, the attacker gains the ability to read sensitive configuration files such as wp-config.php and execute arbitrary PHP code in the web server context.
Root Cause
The root cause is improper sanitization of user-controlled input passed to a file inclusion function within generate_navigation_markup. The function fails to validate that the requested path resolves within an allowed directory or matches an expected file pattern, mapping directly to the [CWE-98] weakness class.
Attack Vector
Exploitation is performed over the network against a vulnerable WordPress endpoint. The attacker authenticates as a contributor or higher, then submits a crafted request to the Onepage Scroll module that manipulates the path parameter consumed by generate_navigation_markup. The plugin resolves and includes the specified file, triggering PHP execution.
// See the Wordfence advisory for full technical details:
// https://www.wordfence.com/threat-intel/vulnerabilities/id/6158ec37-a6fb-42f9-bab6-bf547ea28ea0
// No verified proof-of-concept code is publicly available.
Detection Methods for CVE-2024-3499
Indicators of Compromise
- Unexpected HTTP requests to ElementsKit endpoints containing path traversal sequences such as ../ or absolute filesystem paths
- New or modified PHP files in wp-content/uploads/ or other writable directories not expected to contain executable code
- Contributor accounts issuing requests that reference server files like wp-config.php, /etc/passwd, or PHP session paths
- Unusual outbound connections originating from the PHP-FPM or web server process following contributor logins
Detection Strategies
- Inspect web server access logs for parameters passed to ElementsKit Onepage Scroll routes containing suspicious file path characters
- Monitor WordPress audit logs for contributor-level accounts performing actions inconsistent with content authoring
- Deploy file integrity monitoring on the WordPress installation directory and the wp-content/plugins/elementskit-lite/ path
- Alert on PHP include, require, or file_get_contents operations referencing paths outside the plugin directory
Monitoring Recommendations
- Enable verbose logging on the WordPress application and forward events to a centralized SIEM for correlation
- Track creation of new user accounts with contributor or higher roles, particularly through self-registration
- Monitor for uploads of files with mismatched extensions and content (for example, PHP payloads hidden in image files)
How to Mitigate CVE-2024-3499
Immediate Actions Required
- Update the ElementsKit Elementor Addons plugin to a version above 3.1.0 on all WordPress instances
- Audit existing user accounts and remove or downgrade contributor accounts that are no longer required
- Review recent uploads to wp-content/uploads/ for unexpected files, particularly those with PHP content
- Rotate WordPress secrets, database credentials, and API keys if compromise is suspected
Patch Information
The vendor patched the flaw in the plugin repository. Review the fix in the WordPress plugin changeset 3070789 for elementskit-lite and consult the Wordfence Vulnerability Report for additional context. Apply the update through the WordPress plugin manager or via WP-CLI.
Workarounds
- Disable the ElementsKit Elementor Addons plugin until the update can be applied
- Restrict contributor-level self-registration on public WordPress sites
- Configure the web server to deny PHP execution within writable upload directories
- Deploy a web application firewall rule to block path traversal patterns in requests targeting ElementsKit endpoints
# Update the plugin using WP-CLI
wp plugin update elementskit-lite
# Verify the installed version is above 3.1.0
wp plugin get elementskit-lite --field=version
# Deny PHP execution in the uploads directory (Apache .htaccess)
# Place this file in wp-content/uploads/
# <FilesMatch "\.(php|phtml|php7|phar)$">
# Require all denied
# </FilesMatch>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
