CVE-2024-56282

High

Published: 07 January 2025

Published

07 January 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0342 87.7th percentile

Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-56282 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 12.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2024-56282 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Local File Inclusion (CWE-98), in the Elicus WPMozo Addons Lite for Elementor WordPress plugin (wpmozo-addons-lite-for-elementor). It affects all versions from n/a through 1.1.0, enabling attackers to include arbitrary local files via insufficient validation of user-supplied input in PHP include/require operations.

The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires network access, high attack complexity, and low privileges such as an authenticated user account, with no user interaction needed. Successful exploitation can result in high impacts to confidentiality, integrity, and availability, allowing the inclusion of sensitive local files that may lead to data exposure or further compromise depending on the target's configuration.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wpmozo-addons-lite-for-elementor/vulnerability/wordpress-wpmozo-addons-lite-for-elementor-plugin-1-1-0-local-file-inclusion-vulnerability?_s_id=cve. Security practitioners should update to a patched version if available and review access controls for the plugin.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2024-53079

Vulnerability details

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elicus WPMozo Addons Lite for Elementor wpmozo-addons-lite-for-elementor allows PHP Local File Inclusion.This issue affects WPMozo Addons Lite for Elementor: from n/a through <= 1.1.0.

CWE(s): CWE-98

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

LFI vulnerability in public-facing WordPress plugin directly enables exploitation of public-facing applications for arbitrary local file access and potential further compromise.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1