CVE-2024-37547 is an improper limitation of a pathname to a restricted directory (CWE-22) vulnerability in Livemesh Addons for Elementor, versions up to 8.4.0. This flaw enables a path traversal attack where an attacker with low privileges can potentially read sensitive files outside the intended directory structure. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity, with network attack vector, low attack complexity, and no user interaction required. No official patch or remediation level has been published by the vendor as of the current data.

The vulnerability allows an attacker with low privileges to read files outside the restricted directory, potentially exposing sensitive information. The impact is limited to confidentiality as integrity and availability are not affected. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for suspicious activity related to file access. Avoid granting unnecessary privileges to users who can interact with the plugin.