CVE-2024-5455 is a Local File Inclusion vulnerability (CWE-98) in The Plus Addons for Elementor Page Builder Pro WordPress plugin. It affects all versions up to and including 5.5.4. The vulnerability arises from improper control of the 'magazine_style' parameter in the Dynamic Smart Showcase widget, allowing authenticated users with Contributor-level permissions or higher to include arbitrary files on the server. This can result in execution of arbitrary PHP code, enabling attackers to bypass access controls, access sensitive information, or execute code remotely. The vulnerability has a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. There is no indication of an official patch or vendor advisory at this time, and no known exploits have been observed in the wild.

Successful exploitation allows authenticated attackers with Contributor-level or higher access to execute arbitrary PHP code on the server via Local File Inclusion. This can lead to bypassing access controls, unauthorized data disclosure, and full remote code execution, severely compromising the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access and above to trusted users only. Monitor for updates from the vendor or plugin maintainers and apply patches promptly once released.