The WPZOOM Addons for Elementor plugin suffers from a CWE-22 Path Traversal vulnerability via the 'grid_style' parameter, enabling unauthenticated attackers to perform Local File Inclusion (LFI). This flaw allows attackers to include arbitrary files, including those containing malicious PHP code, resulting in remote code execution, data disclosure, and access control bypass. The vulnerability affects all plugin versions up to and including 1.1.37. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation allows unauthenticated attackers to execute arbitrary PHP code on the server, bypass access controls, and access sensitive data. This can lead to full compromise of the affected WordPress site and potentially the underlying server environment. The vulnerability is critical with a CVSS score of 9.8, indicating a severe impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the affected plugin to prevent exploitation. Monitor for updates from WPZOOM and apply patches promptly once available.