CVE-2024-3499: 
WordPress vulnerability analysis and mitigation

The ElementsKit Elementor addons plugin for WordPress contains a Local File Inclusion vulnerability (CVE-2024-3499) affecting all versions up to and including 3.1.0. The vulnerability exists in the generate_navigation_markup function of the Onepage Scroll module (NVD).

The vulnerability allows authenticated attackers with contributor-level access or higher to include and execute arbitrary files on the server through the generate_navigation_markup function. This enables the execution of any PHP code contained within those files. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Wordfence).

The vulnerability can be exploited to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other "safe" file types can be uploaded and included. This presents a significant security risk as it allows authenticated users to potentially execute malicious code on the affected server (NVD).

The vulnerability requires an authenticated user with contributor-level access or higher to exploit. The attack vector is network-accessible, requires low attack complexity, and no user interaction (Wordfence).

Users should update to ElementsKit Elementor addons version 3.1.1 or later which contains the fix for this vulnerability. The patch has been made available through the WordPress plugin repository (WordPress Patch).