CVE-2024-3500 Overview
The ElementsKit Pro plugin for WordPress contains a Local File Inclusion (LFI) vulnerability affecting all versions up to and including 3.6.0. The flaw exists in the Price Menu, Hotspot, and Advanced Toggle widgets. Authenticated attackers with contributor-level access or higher can include and execute arbitrary files on the server. Successful exploitation allows execution of PHP code from included files, enabling access control bypass, sensitive data disclosure, and remote code execution when combined with file upload capabilities. The issue is tracked under CWE-98 (Improper Control of Filename for Include/Require Statement). CVE-2024-43996 is potentially a duplicate of this issue.
Critical Impact
Contributor-level attackers can achieve arbitrary PHP code execution on WordPress sites running ElementsKit Pro 3.6.0 or earlier by exploiting LFI in three widget components.
Affected Products
- Wpmet ElementsKit Pro for WordPress — all versions up to and including 3.6.0
- Price Menu widget
- Hotspot widget and Advanced Toggle widget
Discovery Timeline
- 2024-05-02 - CVE-2024-3500 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-3500
Vulnerability Analysis
The vulnerability is a Local File Inclusion flaw in the ElementsKit Pro plugin. Attackers supply user-controlled input that reaches PHP include or require statements without proper sanitization. The three affected widgets — Price Menu, Hotspot, and Advanced Toggle — accept file path parameters that the plugin does not validate against an allowlist.
An authenticated attacker with at least contributor privileges can craft widget configurations that reference arbitrary local files. When the widget renders, PHP interprets and executes the referenced file. This turns any writable file on the server — including uploaded images or logs — into an execution vector.
The attack requires network access, low complexity, and low privileges. No user interaction is needed. The result is full compromise of confidentiality, integrity, and availability on the affected site.
Root Cause
The root cause is improper control of filename parameters passed to file inclusion functions (CWE-98). The affected widgets accept path-like inputs from widget settings stored in post metadata. The plugin passes these values directly to PHP include statements without normalizing paths, restricting them to a safe base directory, or enforcing an allowlist of permitted templates.
Attack Vector
Exploitation requires an authenticated session at contributor level or higher. Contributor accounts can create draft posts and populate widget configurations. An attacker inserts a malicious widget that references a local file path — for example, a previously uploaded image containing embedded PHP or a server log file. When the post is previewed or rendered, the plugin includes the attacker-controlled file and PHP executes any code it contains. Refer to the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2024-3500
Indicators of Compromise
- Unexpected PHP files or web shells appearing under wp-content/uploads/ or plugin directories
- Post revisions from contributor accounts containing widget settings with suspicious file path values referencing ../, absolute paths, or non-template files
- Web server access logs showing widget preview or render requests followed by outbound connections to unfamiliar hosts
- New or modified administrative user accounts following contributor login activity
Detection Strategies
- Audit WordPress postmeta entries for ElementsKit widget configurations containing path traversal sequences or references outside expected template directories
- Monitor PHP process execution for include or require calls originating from ElementsKit Pro widget handlers with non-standard file paths
- Correlate contributor-level authentication events with subsequent post creation and preview activity targeting Price Menu, Hotspot, or Advanced Toggle widgets
Monitoring Recommendations
- Enable WordPress activity logging for post creation, post preview, and widget configuration changes by contributor and author roles
- Alert on file writes to wp-content/uploads/ where the file contains PHP tags (<?php) regardless of extension
- Track outbound network connections from the PHP-FPM or web server process to detect post-exploitation callbacks
How to Mitigate CVE-2024-3500
Immediate Actions Required
- Update ElementsKit Pro to a version later than 3.6.0 as published in the ElementsKit Changelog
- Audit all contributor, author, and editor accounts and remove any that are inactive or unrecognized
- Review the wp-content/uploads/ directory for unexpected PHP files and remove them after preserving forensic copies
- Rotate WordPress salts, administrative passwords, and any API keys stored in wp-config.php if compromise is suspected
Patch Information
Wpmet has released a fixed version of ElementsKit Pro that addresses the LFI vulnerability. Consult the ElementsKit Changelog for the exact fixed version and apply the update through the WordPress plugin manager or by replacing plugin files manually.
Workarounds
- Restrict contributor and author role assignment to trusted users only until the patch is applied
- Deactivate the ElementsKit Pro plugin if immediate patching is not possible
- Configure a web application firewall to block requests containing path traversal patterns targeting ElementsKit widget endpoints
- Set open_basedir in PHP configuration to restrict file inclusion to the WordPress installation directory tree
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
