CVE-2026-1620 - Vulnerability Analysis

Overview

Livemesh Addons for Elementor <= 9.0 contains a local file inclusion caused by insufficient sanitization of the template name parameter in lae_get_template_part(), letting authenticated contributors include and execute arbitrary local files, exploit requires tricking an administrator or installing Elementor.

Severity & Score

Impact

Authenticated contributors can include and execute arbitrary local files, potentially leading to full server compromise.

Mitigation

Update to the latest version beyond 9.0.

References

• https://plugins.trac.wordpress.org/browser/addons-for-elementor/tags/9.0/includes/helper-functions.php#L669
• https://plugins.trac.wordpress.org/browser/addons-for-elementor/tags/9.0/includes/helper-functions.php#L671
• https://plugins.trac.wordpress.org/browser/addons-for-elementor/trunk/includes/helper-functions.php#L669
• https://plugins.trac.wordpress.org/browser/addons-for-elementor/trunk/includes/helper-functions.php#L671
• https://www.wordfence.com/threat-intel/vulnerabilities/id/2483875a-84de-4a40-a69e-aee68da1ce3b?source=cve

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner