The Elementor plugin for WordPress contains a path traversal vulnerability (CWE-22) in the Import_Images::import() function due to inadequate restrictions on the filename parameter. Authenticated attackers with administrator or higher privileges can exploit this flaw to read arbitrary files on the server, potentially disclosing sensitive information. This affects all versions up to 3.30.2. The CVSS 3.1 base score is 4.9, reflecting a medium severity with network attack vector, low attack complexity, and high confidentiality impact but no integrity or availability impact. No patch or official fix has been documented in the provided data.

An attacker with administrator-level access can read arbitrary files on the server hosting the Elementor plugin, potentially exposing sensitive information such as configuration files, credentials, or other protected data. The vulnerability does not impact integrity or availability but poses a confidentiality risk. Since exploitation requires high privileges, the threat is limited to already trusted users with elevated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted personnel only and monitor for suspicious activity. Avoid using vulnerable versions of the Elementor plugin if possible. No vendor-provided patch or temporary fix information is currently available.