Elementor < 2.7.5 - Authenticated Arbitrary File Upload

The Elementor plugin (version 2.7.4 and below) was found to be vulnerable to an arbitrary file upload. Due to the application not handling zip files with directories properly an attacker could upload php files which were executable, this allowed any user able to import templates (WordPress role “Contributor” or above) to execute commands on the underlying server.