The vulnerability identified as CVE-2024-43281 involves improper limitation of a pathname to a restricted directory (CWE-22) in the Void Elementor Post Grid Addon for Elementor Page builder. This flaw enables PHP Local File Inclusion, potentially allowing an attacker to include and execute arbitrary files on the server. The affected product versions include all versions up to 2.3. The CVSS 3.1 base score is 5.3, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation could lead to disclosure of sensitive information through local file inclusion, impacting confidentiality. There is no indication of impact on integrity or availability. The attack requires network access with low privileges and has high complexity, reducing the likelihood of widespread exploitation. No known exploits are currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected plugin and monitor for updates from VOID CODERS. Avoid exposing the vulnerable plugin to untrusted users or networks where possible.