CVE-2024-3499

The ElementsKit Elementor Addons plugin through version 3.1.0 contains a local file inclusion flaw in the Onepage Scroll module's generate_navigation_markup function that allows authenticated users with contributor privileges or higher to include and execute arbitrary files from the server. By exploiting this vulnerability, attackers can run arbitrary PHP code, potentially compromising access controls, exposing confidential information, or executing malicious code when combined with uploads of executable files disguised as safe file types. The issue was remedied in version 3.1.1.

Based on public CVE data (MITRE/NVD).