The Plus Addons for Elementor PRO <= 4.1.9 & The Plus Addons for Elementor <= 2.0.6…
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-73 and the CVSS impact.
Summary
The Plus Addons for Elementor plugin for WordPress is vulnerable to arbitrary file reads in versions up to, and including 4.1.9 (pro) and 2.0.6 (free). The plugin has a feature to add an "Info Box" to an Elementor created page. This Info Box can include an SVG image for the box. Unfortunately, the plugin used file_get_contents with no verification that the file being supplied was an SVG file, so any user with access to the Elementor page builder, such as contributors, could read arbitrary files on the WordPress installation.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| posimyththemes | The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce | up to 2.0.6; 4.0 – 4.1.9 | — | No fix listed | CNA |
- The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Vendorposimyththemes Affected up to 2.0.6; 4.0 – 4.1.9 Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:posimyth:the_plus_addons_for_elementor:*:*:*:*:free:wordpress:*:* | up to 2.0.6 | Vulnerable | posimyththemes |
| cpe:2.3:a:posimyth:the_plus_addons_for_elementor:*:*:*:*:pro:wordpress:*:* | up to 4.1.9 | Vulnerable | posimyththemes |
- cpe:2.3:a:posimyth:the_plus_addons_for_elementor:*:*:*:*:free:wordpress:*:* Versions up to 2.0.6 Vulnerable ·posimyththemes
- cpe:2.3:a:posimyth:the_plus_addons_for_elementor:*:*:*:*:pro:wordpress:*:* Versions up to 4.1.9 Vulnerable ·posimyththemes
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-4332
- 2026-10-03 Alias added: GHSA-f2r6-p94g-v5c4
References
Advisory 2
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2523506%40the-plus-addons-for-elementor-page-builder&new=2523506%40the-plus-addons-for-elementor-page-builder&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/aa698e7e-b1c7-4ead-aa2e-7fbfc9dfac80
More posimyththemes The Plus Addons For Elementor vulnerabilities
- TI-2023-25501 WordPress The Plus Addons for Elementor Pro plugin <= 5.2.8 - Unauthenticated Local File Inclusion vulnerability CVSS 3.1CRITICAL 9.8
- TI-2021-06467 The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication Bypass CVSS 3.1CRITICAL 9.8
- TI-2021-07228 The Plus Addons for Elementor Pro < 5.0.7 - Unauthenticated SQL Injection CVSS 3.1CRITICAL 9.8
- TI-2021-03189 Missing authorization in posimyththemes The Plus Addons for Elementor – Addons for… CVSS 3.1HIGH 8.8
- TI-2024-05069 The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu… CVSS 3.1HIGH 8.8
- TI-2024-29521 WordPress The Plus Addons for Elementor plugin <= 5.6.2 - Broken Access Control vulnerability CVSS 3.1HIGH 8.8
Sources
- CVE-2021-4332 · CVE Program
- CVE-2021-4332 · NVD
- FIRST EPSS
- GHSA-f2r6-p94g-v5c4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences