CVE-2024-56282: WPMozo Addons Path Traversal Vulnerability

CVE-2024-56282 Overview

CVE-2024-56282 is a PHP Local File Inclusion (LFI) vulnerability in the Elicus WPMozo Addons Lite for Elementor WordPress plugin. The flaw stems from improper control of the filename passed to a PHP include or require statement, classified under [CWE-98]. An authenticated attacker with low privileges can coerce the plugin into including arbitrary local PHP files, enabling code execution within the WordPress process. The issue affects all plugin versions up to and including 1.1.0.

Critical Impact
Attackers with low-privileged WordPress accounts can include and execute arbitrary local PHP files, compromising site confidentiality, integrity, and availability.

Affected Products

Elicus WPMozo Addons Lite for Elementor plugin for WordPress
All versions from n/a through 1.1.0
WordPress sites using the wpmozo-addons-lite-for-elementor plugin

Discovery Timeline

2025-01-07 - CVE-2024-56282 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-56282

Vulnerability Analysis

The WPMozo Addons Lite for Elementor plugin passes attacker-influenced input into a PHP file-inclusion statement without sufficient validation. When the plugin resolves a filename for include, require, include_once, or require_once, it accepts user-supplied values that traverse the local filesystem. This turns any readable .php file on the server into executable code within the WordPress request context. Because the attack requires network access and low-privilege authentication, any subscriber-tier or contributor-tier account becomes an exploitation foothold.

Successful exploitation gives the attacker code execution as the web server user. From that position, they can read WordPress secrets in wp-config.php, escalate to administrator, and pivot into the underlying host. The attack complexity is elevated because the attacker must know or guess valid file paths on the target system. EPSS data places this issue at roughly the 49th percentile of exploitation likelihood.

Root Cause

The root cause is [CWE-98]: Improper Control of Filename for Include/Require Statement in PHP Program. The plugin does not enforce an allowlist of includable templates, does not canonicalize paths against a base directory, and does not strip traversal sequences such as ../ from user input before concatenating it into an inclusion call.

Attack Vector

Exploitation is remote over the network. An authenticated user submits a crafted request to a vulnerable plugin endpoint, supplying a path parameter that resolves to a local PHP file. The PHP interpreter loads and executes that file inline with the current request. See the Patchstack advisory for endpoint specifics.

// No verified public exploit code is available.
// Refer to the Patchstack advisory for technical details.

Detection Methods for CVE-2024-56282

Indicators of Compromise

HTTP requests to wpmozo-addons-lite-for-elementor plugin endpoints containing path traversal sequences such as ../ or absolute filesystem paths.
Unexpected PHP file reads from directories outside wp-content/plugins/wpmozo-addons-lite-for-elementor/.
New administrator accounts or modified wp-config.php timestamps following plugin request activity.
Outbound connections from the PHP-FPM or Apache worker process to unfamiliar hosts after suspicious plugin requests.

Detection Strategies

Inspect web server access logs for plugin URLs carrying file, template, path, or similar parameters with traversal characters.
Correlate authenticated low-privilege sessions with requests to plugin AJAX or REST endpoints that trigger file inclusion.
Alert on PHP process file opens outside the plugin's own directory tree using file integrity monitoring or eBPF-based sensors.

Monitoring Recommendations

Forward WordPress and web server logs to a centralized analytics platform and query for LFI patterns against the affected plugin path.
Monitor WordPress role changes and administrator creations in real time.
Enable PHP error logging and review E_WARNING entries for include() and require() failures that reveal probing.

How to Mitigate CVE-2024-56282

Immediate Actions Required

Update WPMozo Addons Lite for Elementor to a version later than 1.1.0 once the vendor releases a fixed build.
If no patched version is available, deactivate and remove the plugin from all WordPress installations.
Rotate WordPress secret keys, database credentials, and administrator passwords on any site that ran the vulnerable plugin.
Audit user accounts and remove unexpected administrator or editor roles.

Patch Information

At the time of publication, the Patchstack advisory lists versions through 1.1.0 as affected. Site operators should monitor the plugin repository for a patched release and apply it as soon as it becomes available.

Workarounds

Deploy a Web Application Firewall rule that blocks requests to the plugin containing ../, null bytes, or absolute paths.
Restrict access to wp-admin and plugin AJAX endpoints by IP allowlist while the plugin remains installed.
Configure PHP open_basedir to confine file inclusion to the WordPress document root.
Remove low-privilege user self-registration until the plugin is patched or removed.

bash

# Example php.ini hardening to constrain file inclusion scope
open_basedir = "/var/www/html:/tmp"
allow_url_include = Off
allow_url_fopen = Off