CVE-2026-103082 PUBLISHED

WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Server Side Request Forgery (SSRF) vulnerability

Assigner: Patchstack
Reserved: 30.09.2026 Published: 01.10.2026 Updated: 01.10.2026

Server-Side Request Forgery (SSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Server Side Request Forgery.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS Score: 7.2

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	None	Integrity Impact	Low
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	LA-Studio
Product	LA-Studio Element Kit for Elementor
Versions	Default: unaffected affected from 0 to 1.6.2 (incl.)

Solutions

Update the WordPress LA-Studio Element Kit for Elementor plugin to the latest available version (at least 1.6.3).

Credits

JunHee CHO | Patchstack Bug Bounty Program finder

References

https://patchstack.com/database/wordpress/plugin/lastudio-element-kit/vulnerability/wordpress-la-studio-element-kit-for-elementor-plugin-1-6-2-server-side-request-forgery-ssrf-vulnerability?_s_id=cve

Problem Types

Server-Side Request Forgery (SSRF) CWE

Impacts

Server Side Request Forgery