CVE-2020-7055: 
WordPress vulnerability analysis and mitigation

An arbitrary file upload vulnerability was discovered in Elementor version 2.7.4 and below. The vulnerability exists in the Elementor Import Templates function, which allows attackers to execute code via a crafted ZIP archive (NVD, WPScan).

The vulnerability stems from improper handling of zip files with directories in the template import functionality. Due to this implementation flaw, attackers could upload PHP files that become executable on the server. This vulnerability affects users with WordPress role of 'Contributor' or above who have access to import templates (WPScan).

If successfully exploited, this vulnerability allows authenticated users to execute commands on the underlying server, potentially leading to complete server compromise (WPScan).

The vulnerability requires authentication with at least Contributor-level access to the WordPress installation. The attacker needs to be able to access the template import functionality to exploit this vulnerability (WPScan).

The vulnerability has been fixed in Elementor version 2.7.5. Users are advised to update to this version or later to protect against this security issue (WPScan).