CVE-2024-4887

The Qi Addons For Elementor plugin through version 1.7.2 contains a local file inclusion vulnerability in the qi_addons_for_elementor_blog_list shortcode's behavior attributes. Users with Contributor level permissions or higher can exploit this flaw to include and execute arbitrary PHP files from the server, potentially leading to unauthorized access to sensitive information or remote code execution. Successful exploitation requires either creation of a non-existent directory path or specific server conditions where file existence checks do not fail as expected.

Based on public CVE data (MITRE/NVD).