CVE-2024-5455 is a High severity (CVSS 8.8) local file inclusion flaw in The Plus Addons for Elementor Page Builder, a WordPress plugin, in all versions up to and including 5.5.4. Authenticated users with Contributor access or higher can include and run files on the server. Update to the latest release and check the vendor changelog for the exact fixed build.
What's affected
- Product: The Plus Addons for Elementor Page Builder, a WordPress plugin by POSIMYTH.
- Affected versions: all versions up to and including 5.5.4. The weak spot is the magazine_style parameter in the Dynamic Smart Showcase widget.
- Fixed version: the record does not name one, and the vendor page linked from it is a feature request board, not a changelog, so I could not confirm a number. Wordfence's page, which the record also links, blocked my request. Assume 5.5.5 or later is the fix only after you read the changelog in your WordPress dashboard or the vendor's site.
- Severity: High, CVSS 8.8. The attacker needs a logged in account with at least Contributor rights.
- Exploitation: the record's KEV flag is false. No source I read says it is exploited in the wild.
How to check if you're exposed
On a single site, open the Plugins page in the WordPress dashboard and read the version beside The Plus Addons for Elementor. Anything at 5.5.4 or older is affected.
On many sites, WP-CLI makes it quick:
wp plugin list --fields=name,version,status | grep -i "the-plus-addons"
The package slug can differ between the free and Pro builds, so also search the plugin directory for plus addons.
Then look at your users. List accounts with the Contributor, Author, Editor or Administrator roles. Because the flaw needs one of those logins, sites that allow open registration at Contributor level, or that have old guest author accounts, have the widest exposure.
wp user list --role=contributor --fields=ID,user_login,user_registered
What to do now
- Update The Plus Addons for Elementor on every site. If auto updates are off, turn them on for this plugin.
- Read the vendor changelog and confirm that the installed version is later than 5.5.4 and mentions a security fix.
- Audit Contributor and higher accounts. Remove any that nobody recognizes, and reset passwords where you are unsure.
- Check whether your site lets visitors register. If it does, confirm the default role is the lowest one that works for you.
- Review the uploads folder for files that do not belong. The record notes the inclusion becomes more dangerous where images and other normally safe file types can be uploaded and then included.
- Back up before updating, as page builder add-ons can affect layouts.
Why it matters
The record maps this to CWE-98, improper control of filename for include or require in PHP. A widget option controls which file the plugin loads, and the value is not limited to the files the plugin intended. If a user can choose the file, they can choose a file that contains code.
Contributor is a low bar on many WordPress sites. It is the role handed to guest writers, and it is sometimes the default for new registrations. That is why a plugin flaw that needs only that role scores 8.8 and deserves a quick update, even though an attacker has to hold a login first.
Quick check
Do I need to be an administrator to exploit CVE-2024-5455?
No. According to the record, Contributor level access and above is enough, which makes account hygiene part of the fix.
How do I confirm the plugin is patched?
Check that the installed version is newer than 5.5.4 and that the vendor changelog lists a security fix. The record itself does not name the fixed build.
Sources
- The Plus Addons for Elementor vendor site, linked from the record (a feature request board when I read it, not a changelog)
- Wordfence vulnerability entry linked from the record (blocked my request, so its contents are not used here)
- NVD record data for CVE-2024-5455, as supplied in the batch record
Last reviewed: 19 October 2026.
