The vulnerability CVE-2024-49243 affects the Dynamic Elementor Addons plugin by ramjon27, specifically versions up to 1.0.0. It arises from improper validation or control of filenames used in PHP include or require statements, which can lead to Local File Inclusion. This allows an attacker with limited privileges to potentially include and execute arbitrary files on the server, impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.5, with network attack vector, high attack complexity, low privileges required, no user interaction, and high impact on all three security properties. No patch or official fix has been documented, and the plugin is not a cloud service, so remediation depends on vendor updates or user action.

Successful exploitation of this vulnerability can lead to arbitrary code execution, disclosure of sensitive files, or denial of service on affected systems running Dynamic Elementor Addons version 1.0.0 or earlier. The attacker requires network access and low privileges but no user interaction. The high CVSS score reflects the potential for significant compromise of confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin to mitigate risk. Monitor vendor communications for updates regarding patches or mitigations. Avoid exposing the vulnerable plugin to untrusted networks or users with low privileges.