CVE-2024-5179 Overview
CVE-2024-5179 is a Local File Inclusion (LFI) vulnerability in the Cowidgets – Elementor Addons plugin for WordPress. The flaw affects all versions up to and including 1.1.2 and stems from unsafe handling of the item_style and style parameters across multiple widget classes. Authenticated attackers holding Contributor-level access or higher can include and execute arbitrary PHP files on the affected server. The issue is tracked under CWE-22 (Path Traversal) and is likely a duplicate of CVE-2024-37419.
Critical Impact
Authenticated Contributor-level users can achieve remote code execution by including arbitrary PHP files, enabling access-control bypass, sensitive data theft, and full site compromise when combined with file uploads.
Affected Products
- Codeless Cowidgets – Elementor Addons plugin for WordPress, all versions ≤ 1.1.2
- Affected widget files include class-ce-portfolio-grid.php, class-ce-post-navigation.php, class-ce-posts-carousel.php, class-ce-posts-grid.php, class-ce-staff-carousel.php, and class-ce-testimonial-carousel.php
- WordPress installations running the plugin alongside Elementor
Discovery Timeline
- 2024-06-06 - CVE-2024-5179 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-5179
Vulnerability Analysis
The Cowidgets – Elementor Addons plugin renders widget templates by passing user-influenced values from the item_style and style parameters into PHP include statements. Because the plugin does not validate or whitelist the requested template names, an attacker can supply traversal sequences or arbitrary paths to reference files outside the intended template directory. When the include executes, PHP evaluates the target file as code, giving the attacker execution in the web server context.
Exploitation requires an authenticated session at Contributor level or higher, which is a common threshold on multi-author WordPress sites and sites accepting guest contributions. Contributors can create and edit posts containing Elementor widgets, providing a direct path to reach the vulnerable widget rendering logic. When the target hosts allow media uploads of image files, an attacker can plant PHP payloads inside seemingly benign files and include them through the LFI to achieve remote code execution.
Root Cause
The root cause is missing input validation on the item_style and style widget parameters, which are concatenated into PHP include/require calls. The plugin trusts client-supplied style identifiers instead of mapping them to a fixed set of template files. This design permits directory traversal (../) and inclusion of arbitrary local files, including uploaded content, session files, or logs containing attacker-controlled data.
Attack Vector
The attack is network-reachable and requires only Contributor privileges. An authenticated attacker submits or updates an Elementor page containing a vulnerable widget and sets the item_style or style attribute to a traversal string pointing to a PHP file previously uploaded through the media library or another writeable location. Rendering the page triggers the include and executes the payload. See the Wordfence Vulnerability Report for additional technical detail.
No public proof-of-concept exploit code is referenced in the advisory. Refer to the WordPress Plugin Changeset for the vendor fix diff.
Detection Methods for CVE-2024-5179
Indicators of Compromise
- Requests to WordPress endpoints containing item_style or style parameters with ../ traversal sequences or absolute paths
- Unexpected PHP files inside wp-content/uploads/ or other writable directories, especially with double extensions such as .jpg.php
- Web server error or access logs showing includes of files outside the plugin template directory inc/widgets-manager/widgets/content/
- New administrator accounts, modified wp-config.php, or unfamiliar scheduled tasks created shortly after Elementor page edits
Detection Strategies
- Inspect Elementor widget metadata stored in wp_postmeta for item_style or style values containing traversal characters or unexpected paths
- Enable and review PHP open_basedir violations and web application firewall (WAF) rules that block path traversal patterns in POST bodies
- Audit Contributor and Author accounts created or elevated near the vulnerability window
Monitoring Recommendations
- Alert on file writes to wp-content/uploads/ where the resulting file type is PHP or where extensions are mismatched
- Monitor outbound network connections initiated from PHP-FPM or the web server user immediately after admin-ajax or Elementor preview requests
- Correlate authenticated Contributor logins with subsequent modifications to post meta containing widget styling parameters
How to Mitigate CVE-2024-5179
Immediate Actions Required
- Update the Cowidgets – Elementor Addons plugin to a version newer than 1.1.2 that contains the vendor patch
- Audit all Contributor, Author, and Editor accounts and remove or disable any that are unused or suspicious
- Search wp-content/uploads/ and other writable directories for unauthorized PHP files and remove them
- Rotate WordPress secret keys in wp-config.php and reset user passwords if compromise is suspected
Patch Information
The vendor released a corrected build tracked in WordPress Plugin Changeset 3099564. The fix constrains item_style and style values to a whitelist of expected template names, preventing arbitrary file inclusion. Site owners running the plugin on WordPress must upgrade beyond version 1.1.2.
Workarounds
- Deactivate and remove the Cowidgets – Elementor Addons plugin until an upgrade is possible
- Restrict Contributor-level accounts on production sites and require administrator review before publishing Elementor pages
- Deploy a WAF rule that blocks path traversal sequences (../, URL-encoded variants) in the item_style and style request parameters
- Configure PHP open_basedir and disable execution of PHP within wp-content/uploads/ via web server rules
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
