CVE-2024-2385: 
WordPress vulnerability analysis and mitigation

The Elementor Addons by Livemesh plugin for WordPress contains a Local File Inclusion vulnerability (CVE-2024-2385) affecting all versions up to and including 8.3.7. The vulnerability exists in several of the plugin's widgets through the 'style' attribute (NVD).

The vulnerability allows authenticated attackers with contributor-level access or higher to include and execute arbitrary files on the server through the plugin's widgets' 'style' attribute. This enables the execution of any PHP code contained within those files. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability can be exploited to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other "safe" file types can be uploaded and included. This gives attackers significant control over the affected WordPress installations (NVD).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack can be executed remotely through the plugin's widgets, making it relatively straightforward to exploit for attackers who meet the authentication requirement (NVD).

Users should immediately update to a version newer than 8.3.7 if available. If an update is not possible, it is recommended to restrict access to contributor-level accounts and carefully monitor file uploads (NVD).