This vulnerability (CVE-2024-37089) in StylemixThemes Consulting Elementor Widgets involves improper limitation of a pathname to a restricted directory (CWE-22), enabling PHP Local File Inclusion. It affects versions up to 1.3.0. The issue allows remote attackers to potentially include and execute arbitrary local files on the server, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates network attack vector with high attack complexity, no privileges required, no user interaction, and scope change. No patch or official remediation has been published yet.

Successful exploitation can lead to full compromise of the affected system, including unauthorized disclosure, modification, or destruction of data, and potential system takeover. The vulnerability affects the confidentiality, integrity, and availability of the affected product. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the affected Consulting Elementor Widgets plugin to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.