CVE-2024-5179: LFI in Cowidgets – Elementor Addons

The impact of CVE-2024-5179 is significant due to the potential for code execution. An attacker who can exploit this vulnerability can upload seemingly harmless files (like images) and then include them via the 'item_style' or 'style' parameters, effectively executing arbitrary PHP code. This could allow them to bypass access controls, steal sensitive data stored on the server, modify website content, or even gain complete control of the WordPress instance. The attack surface is broad, as any user with Contributor access or higher can potentially exploit this flaw. The ability to execute arbitrary code represents a severe compromise of the website's security.

1. Reserved2024-05-21
2. Published2024-06-06
3. Modified2024-08-01
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-5179 is to upgrade Cowidgets – Elementor Addons to a patched version. If upgrading immediately is not possible due to compatibility issues or breaking changes, consider restricting file upload permissions to prevent attackers from uploading malicious files. Implement strict input validation on the 'item_style' and 'style' parameters to prevent unexpected file inclusions. Web Application Firewalls (WAFs) configured to detect and block attempts to include arbitrary files can also provide a layer of defense. After upgrading, verify the fix by attempting to access a non-existent PHP file through the vulnerable parameters; the request should result in a 404 error or similar, indicating that file inclusion is blocked.