The Pack Elementor addons by Webangon contain a path traversal vulnerability (CWE-22) that allows improper limitation of pathnames to restricted directories. This flaw enables PHP local file inclusion, potentially allowing an attacker with low privileges to access files outside the intended scope. The vulnerability affects versions up to 2.0.8.6. The CVSS v3.1 base score is 4.3, indicating medium severity with network attack vector, low attack complexity, requiring low privileges, no user interaction, and limited confidentiality impact. No official patch or remediation level has been published yet.

An attacker with low privileges can exploit this vulnerability to perform local file inclusion via path traversal, potentially accessing sensitive files on the server. The impact is limited to confidentiality with no integrity or availability impact reported. No known exploits in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected plugin and monitor for updates from Webangon. Avoid exposing the plugin to untrusted users with low privileges. No official fix or temporary workaround has been published.