This vulnerability in Absolute Addons For Elementor arises from improper validation of filenames used in PHP include or require statements, which can lead to Local Code Inclusion. The flaw affects versions up to and including 1.0.14. An attacker with low privileges and no user interaction can exploit this to execute arbitrary code locally, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. No official patch or mitigation guidance is currently available from the vendor.

Successful exploitation allows local code inclusion, which can lead to arbitrary code execution on the affected system. This compromises confidentiality, integrity, and availability of the system running Absolute Addons For Elementor versions up to 1.0.14. The vulnerability requires low privileges but has high attack complexity and no user interaction needed. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable plugin and monitor for suspicious activity. Avoid using affected versions if possible.