CVE-2026-1620 | Livemesh Livemesh Addons by Elementor Plugin up to 9.0 on WordPress Template Name lae_get_template_part filename control

A vulnerability was found in Livemesh Livemesh Addons by Elementor Plugin up to 9.0 on WordPress. It has been classified as critical. Impacted is the function lae_get_template_part of the component Template Name Handler. This manipulation causes improper control of filename for include/require statement in php program (‘php remote file inclusion’).

This vulnerability is handled as CVE-2026-1620. The attack can be initiated remotely. There is not any exploit available.