This vulnerability in WPMozo Addons Lite for Elementor arises from improper validation of filenames used in PHP include or require statements, enabling local file inclusion. It affects all versions up to 1.1.0. The CVSS score of 7.5 indicates high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges without user interaction. No patch or vendor advisory is available to confirm remediation status.

Successful exploitation could allow an attacker with low privileges to include local files on the server, potentially leading to arbitrary code execution, data disclosure, or denial of service. The vulnerability impacts confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the plugin and monitoring for suspicious activity related to file inclusion attempts. Avoid exposing the plugin to untrusted users or inputs that could exploit this vulnerability.