Atomic Edge analysis of CVE-2026-24390 (metadata-based):
The Kentha Elementor Widgets plugin for WordPress versions up to 3.1 contains an authenticated Local File Inclusion vulnerability. This flaw allows users with contributor-level privileges or higher to include arbitrary files from the server, leading to remote code execution. The vulnerability stems from improper validation of user-supplied file paths used in PHP include or require statements.

Atomic Edge research identifies the root cause as CWE-98, Improper Control of Filename for Include/Require Statement. The vulnerability description indicates the plugin fails to properly sanitize or validate a file path parameter before passing it to a file inclusion function like `include()` or `require()`. This inference is based on the CWE classification and the described impact of arbitrary file inclusion. Without a code diff, this conclusion is derived from the standard pattern for this CWE within WordPress plugins, where user input often controls template or widget file paths.

Exploitation likely occurs via a WordPress AJAX handler or a REST API endpoint provided by the plugin. An authenticated attacker with contributor access would send a crafted POST request to `/wp-admin/admin-ajax.php`. The request would contain an `action` parameter matching a vulnerable plugin hook, such as `kentha_elementor_action`, and a parameter like `file` or `template` containing a path traversal payload (e.g., `../../../wp-config.php`). If the server allows file uploads, an attacker could upload a .jpg file containing PHP code via WordPress media uploads, then include that file to achieve code execution.

Remediation requires implementing strict validation and whitelisting for any user input used in file inclusion operations. The patched version should sanitize the filename parameter, restrict allowed directories using a base path, and validate against an allowed list of expected files. Proper capability checks should also be confirmed to ensure only intended users can access the vulnerable functionality. The fix aligns with standard secure coding practices for preventing directory traversal and local file inclusion.

Successful exploitation grants an attacker the ability to read sensitive server files like `wp-config.php`, which contains database credentials and secret keys. This leads to a complete site compromise. In scenarios where file upload is possible, the vulnerability enables arbitrary PHP code execution with the web server’s privileges. Attackers can create new administrative users, manipulate site content, or establish a persistent backdoor, effectively achieving full control over the WordPress installation.