CVE-2026-103082
HighCVSS 7.2Summary
Server-Side Request Forgery (SSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Server Side Request Forgery. This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2.
Risk Assessment
The risk includes the ability to scan internal networks, access internal services, or use the server as a proxy for attacks.
Recommendation
Upgrade LA-Studio Element Kit to a version later than 1.6.2 if available, or apply network-level protections to mitigate SSRF.
Other vulnerabilities in LA-Studio Element Kit
See all- CVE-2026-15338High
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 1.6.1 via the get_type_template function. This allows authenticated attackers with contributor-level access or higher to include and execute arbitrary .php files on the server.
- CVE-2026-12276Medium
The LA-Studio Element Kit for Elementor WordPress plugin before version 1.6.1 does not check whether user registration is enabled on the site before creating an account through one of its unauthenticated AJAX actions. This allows unauthenticated attackers to register new accounts even when registration has been disabled site-wide.
Original NVD description (English source)
Server-Side Request Forgery (SSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Server Side Request Forgery.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS