The JetElements plugin for WordPress contains a path traversal vulnerability (CWE-22) that enables Local File Inclusion through the 'progress_type' parameter. Authenticated attackers with at least Contributor privileges can exploit this flaw to include and execute arbitrary files on the server. This includes the possibility of executing PHP code embedded in uploaded files, even if those files are typically considered safe types such as images. The vulnerability affects all versions up to and including 2.6.20. The CVSS v3.1 base score is 8.8, indicating a high impact with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows attackers to bypass access controls, execute arbitrary PHP code on the server, and potentially access sensitive data. This can lead to full compromise of the affected WordPress site and underlying server. The vulnerability requires authenticated access at Contributor level or above, which limits exposure to some extent but remains critical due to the potential impact.

No official patch or fix is currently confirmed or linked by the vendor. Patch status is not yet confirmed — check the Crocoblock vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the JetElements plugin if possible. Monitor for vendor updates and apply official patches promptly once released.