CVE-2024-4887 is a Local File Inclusion vulnerability (CWE-98) in the Qi Addons For Elementor WordPress plugin, affecting all versions up to 1.7.2. The flaw exists in the handling of the 'behavior' attribute within the qi_addons_for_elementor_blog_list shortcode, allowing authenticated attackers with Contributor-level privileges or higher to include arbitrary PHP files on the server. Successful exploitation enables execution of arbitrary PHP code, potentially bypassing access controls and accessing sensitive data. Exploitation requires the attacker to manipulate directory existence checks to bypass file existence validation. No patch or official remediation guidance is currently available from the vendor.

This vulnerability allows authenticated users with Contributor-level access or above to execute arbitrary PHP code on the affected server by including malicious PHP files. This can lead to full compromise of the WordPress site, including bypassing access controls and unauthorized data access. The CVSS score of 7.5 (High) reflects the network attack vector, low privileges required, and high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and monitor for suspicious activity related to the qi_addons_for_elementor_blog_list shortcode usage. Avoid uploading PHP files or enabling file uploads that could be included via this vulnerability.