The SinaExtra Sina Extension for Elementor plugin suffers from a CWE-22 path traversal vulnerability that enables PHP Local File Inclusion. This occurs due to insufficient validation or restriction of file pathnames, allowing an attacker with low privileges to access files outside intended directories. The vulnerability affects all versions up to 3.5.1. The CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No patch or mitigation is currently documented by the vendor.

Successful exploitation can lead to disclosure of sensitive files on the server due to local file inclusion, compromising confidentiality. There is no direct impact on system integrity or availability. The attacker requires low privileges on the system, and the attack can be performed remotely over the network without user interaction. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable plugin, limit user privileges, and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the plugin to untrusted users or networks. Follow vendor channels for updates on patches or official mitigations.