JetElements <= 2.6.20 - Authenticated (Contributor+) Arbitrary Local File Inclusion

The impact of this vulnerability is significant due to its potential for remote code execution (RCE). An attacker with Contributor access can exploit this LFI to include and execute arbitrary PHP code. This could allow them to bypass access controls, steal sensitive data stored on the server, modify website content, or even gain complete control of the WordPress instance. The ability to execute arbitrary code opens the door to a wide range of malicious activities, including installing backdoors, injecting malware, and defacing the website. Successful exploitation could lead to a complete compromise of the WordPress environment.

WordPress websites using the JetElements plugin, particularly those with multiple users having Contributor-level access or higher, are at risk. Shared hosting environments where users have limited control over file permissions are also particularly vulnerable. Sites using older, unpatched versions of the plugin are most susceptible to exploitation.

• wordpress / composer / npm:

grep -r 'progress_type' /var/www/html/wp-content/plugins/jet-elements/

• wordpress / composer / npm:

wp plugin list --status=all | grep jet-elements

• wordpress / composer / npm:

find /var/www/html/wp-content/uploads/ -type f -name '*.php'

1. 2024-08-16Disclosure

   disclosure

1. Reserviert2024-07-26
2. Veröffentlicht2024-08-16
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-7145 is to immediately upgrade the JetElements plugin to a version that addresses the vulnerability. The vendor has not specified a fixed version, so check the official JetElements website for the latest release. If upgrading is not immediately possible due to compatibility issues or breaking changes, consider temporarily restricting file uploads to only explicitly allowed file types. While not a complete solution, this can reduce the attack surface. Monitor WordPress access logs for suspicious activity, particularly attempts to access unusual file paths. After upgrading, verify the fix by attempting to access a non-existent file through the vulnerable parameter; it should result in a 404 error.