What’s Vulnerable › Vulnerabilities
CVE-2024-6459: News Element Elementor Blog Magazine < 1.0.6 - Unauthenticated LFI
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.0% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2024-08-17 · updated 2026-06-17
Description
The News Element Elementor Blog Magazine WordPress plugin before 1.0.6 is vulnerable to Local File Inclusion via the template parameter. This makes it possible for unauthenticated attacker to include and execute PHP files on the server, allowing the execution of any PHP code in those files.
Affected products
- News Element Elementor Blog Magazine: before 1.0.6 — fixed in 1.0.6
How to fix
Upgrade to a fixed version: News Element Elementor Blog Magazine 1.0.6. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-6459 or the next vulnerability affects your stack