This vulnerability (CVE-2024-33541) in BetterAddons Better Elementor Addons involves improper limitation of a pathname to a restricted directory (CWE-22), enabling PHP Local File Inclusion. It affects versions up to 1.4.1. The CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. No patch or official remediation level has been provided by the vendor as of the publication date.

An attacker with low privileges can exploit this vulnerability remotely to include local files via PHP, potentially exposing sensitive information on the affected system. The confidentiality of data is at risk, but integrity and availability are not impacted. There are no known active exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected plugin or applying temporary controls such as disabling the plugin if feasible. Monitor vendor channels for updates.