CVE-2024-43281: 
WordPress vulnerability analysis and mitigation

A Local File Inclusion vulnerability (CVE-2024-43281) was discovered in VOID CODERS Void Elementor Post Grid Addon for Elementor Page builder through version 2.3. The vulnerability was reported on June 24, 2024, and publicly disclosed on August 16, 2024 (Patchstack).

The vulnerability is classified as an Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) issue that allows PHP Local File Inclusion. It has been assigned a CVSS v3.1 Base Score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating network accessibility with high attack complexity, requiring low privileges, and potentially resulting in high confidentiality impact (Patchstack).

The vulnerability could allow a malicious actor to include local files of the target website and display their contents. This could potentially expose sensitive information, including database credentials, which might lead to complete database compromise depending on the configuration (Patchstack).

The vulnerability requires low privileges (Contributor level access) to exploit, though it has high attack complexity. The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited (Patchstack).

The vulnerability has been fixed in version 2.4 of the plugin. Users are advised to update to version 2.4 or later to remove the vulnerability. Patchstack users can enable auto-update for vulnerable plugins (Patchstack).