What is the CVSS score of CVE-2026-1620?

CVE-2026-1620 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-1620?

Livemesh Addons for Elementor (WordPress plugin) version 9.0 and below contains a local file inclusion vulnerability that allows authenticated contributors to execute arbitrary PHP code on affected…

How to fix or mitigate CVE-2026-1620?

Within 24 hours: Disable or remove Livemesh Addons for Elementor on all affected WordPress installations (version ≤9.0); audit contributor-level user accounts for suspicious activity. Within 7 days: Identify and test alternative Elementor addon solutions; plan migration of widget templates if applicable. Within 30 days: Complete migration to alternative plugins and re-enable Elementor functionality with approved, patched extensions only.

PHP CVE-2026-1620

EUVD-2026-23205 HIGH

PHP Remote File Inclusion (CWE-98)

2026-04-16 Wordfence

PHP LFI WordPress Path Traversal Elementor

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 20:37 vuln.today

cvss_changed

Analysis Generated

Apr 16, 2026 - 07:50 vuln.today

EUVD ID Assigned

Apr 16, 2026 - 07:30 euvd

EUVD-2026-23205

Analysis Generated

Apr 16, 2026 - 07:30 vuln.today

CVE Published

Apr 16, 2026 - 06:44 nvd

HIGH 8.8

DescriptionCVE.org

The Livemesh Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 9.0. This is due to insufficient sanitization of the template name parameter in the lae_get_template_part() function, which uses an inadequate str_replace() approach that can be bypassed using recursive directory traversal patterns. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the attacker to include and execute local files via the widget's template parameter granted they can trick an administrator into performing an action or install Elementor.

AnalysisAI

Local file inclusion in Livemesh Addons for Elementor (WordPress plugin) ≤9.0 allows authenticated attackers with Contributor-level privileges to include and execute arbitrary PHP files via recursive directory traversal bypass in widget template parameters. The vulnerability requires Elementor plugin installation and either admin interaction (social engineering) or direct Contributor access. CVSS 8.8 reflects high impact (RCE potential) but limited by authentication requirement. No active exploitation confirmed (not in CISA KEV), but publicly available exploit code exists (Wordfence disclosure with technical details and code references).

Technical ContextAI

The vulnerability exists in the lae_get_template_part() function within the Livemesh Addons for Elementor plugin's helper-functions.php file. The function performs path sanitization using a flawed str_replace() implementation to filter directory traversal sequences. This approach is vulnerable to recursive bypass techniques where patterns like '....//' or '....//' are processed sequentially, leaving residual '../' sequences after initial sanitization passes. The function then uses the insufficiently sanitized template name parameter in PHP file inclusion operations, enabling Local File Inclusion (CWE-98). When combined with PHP file execution contexts, this LFI becomes Remote Code Execution. The affected product CPE (cpe:2.3:a:livemesh:livemesh_addons_by_elementor) identifies all versions through 9.0 as vulnerable. The attack surface requires both the vulnerable Livemesh Addons plugin AND the Elementor page builder plugin to be installed, as the vulnerable code path is accessed through Elementor widget template rendering.

RemediationAI

Primary mitigation: Upgrade Livemesh Addons for Elementor plugin to version 9.1 or later if available (fix version not independently confirmed from provided data - verify with vendor advisory at Wordfence link or WordPress plugin repository changelog). If patch unavailable or upgrade delayed, implement compensating controls: (1) Remove Contributor-level and Editor-level user accounts for untrusted users, restricting content creation to Administrator-only (trade-off: reduces collaborative workflows); (2) Implement Web Application Firewall rules blocking HTTP requests containing recursive directory traversal patterns in Elementor widget parameters (patterns: '....//', '....//', nested '../' sequences); (3) Apply PHP disable_functions directive to restrict file inclusion functions if application architecture permits (trade-off: may break legitimate plugin functionality); (4) Monitor server logs for unusual file access patterns to /etc/passwd, /wp-config.php, or PHP files outside standard plugin directories. Temporary risk reduction: Deactivate Livemesh Addons for Elementor plugin until patch confirmation if business impact is acceptable. Advisories: https://www.wordfence.com/threat-intel/vulnerabilities/id/2483875a-84de-4a40-a69e-aee68da1ce3b?source=cve.