This vulnerability (CVE-2024-37092) in StylemixThemes Consulting Elementor Widgets involves improper limitation of a pathname to a restricted directory (CWE-22), enabling PHP Local File Inclusion. It affects versions up to 1.3.0. The CVSS 3.1 base score is 8.5, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed as of the publication date.

Successful exploitation allows an attacker to include local files via PHP, potentially leading to full system compromise including disclosure, modification, or destruction of data and disruption of service. The vulnerability impacts confidentiality, integrity, and availability at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for suspicious activity. Avoid exposing the vulnerable component to untrusted networks.