CVE-2022-0320

Essential Addons for Elementor fails to validate and sanitize certain template data before using it in include statements, letting an unauthenticated attacker perform local file inclusion and read arbitrary files off the server. The description is explicit that this doesn't necessarily stop at file reads: LFI here can escalate to remote code execution via user-uploaded files or the usual LFI-to-RCE techniques. So the floor is arbitrary file disclosure (think wp-config.php and its database credentials) and the ceiling is code execution.

This is a maximally exposed combination — a hugely popular WordPress plugin, no authentication, and a path that reads sensitive files or worse. That's precisely the profile mass-scanning botnets prioritize, and proof-of-concept traffic for popular-plugin unauth bugs typically arrives within days, hammering every reachable install regardless of who runs it. Even used only for file reads, leaking wp-config.php hands over the database and effectively the site; chained to RCE it's full server compromise. The version ceiling, before 5.0.5, is the whole defense.

WordPress plugins are the hardest software to inventory — installed per-site, often by non-technical owners, almost never tracked centrally — so our work isn't reading the advisory, it's answering which of the sites we touch actually run Essential Addons for Elementor, at what version, and whether the vulnerable path is internet-reachable. That intersection collapses a scary headline into a short, ranked patch list. Anything exposed and below 5.0.5 we treat as potentially already read, meaning credential rotation, not just patching.