The vulnerability CVE-2024-49251 in Acnoo Maan Addons For Elementor arises from improper validation of filenames used in PHP include or require statements. This weakness allows Local Code Inclusion, enabling an attacker with limited privileges to potentially execute arbitrary code on the affected system remotely. The issue affects all versions up to and including 1.0.1. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but no user interaction. No patch or official fix has been published by the vendor as of the current information.

Successful exploitation could lead to remote code execution on the affected system, compromising confidentiality, integrity, and availability of the application and potentially the underlying server. The attacker needs only low privileges and no user interaction, making this a serious threat. However, no known exploits have been reported in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.