The vulnerability CVE-2024-52499 affects the Ibrahim Pricing table addon for Elementor up to version 1.0.0. It is caused by improper validation or control of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker with low privileges to execute arbitrary code by including local files. The CVSS v3.1 base score is 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity. No patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability could lead to an attacker including and executing arbitrary local files on the server running the vulnerable addon. This can result in full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability requires network access and low privileges but has a high attack complexity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable addon to prevent exploitation. Monitor vendor channels for updates and apply any official patches promptly once available.