CVE-2026-65488
HighCVSS 7.1Summary
The LA-Studio Element Kit for Elementor plugin version 1.6.2 and earlier has an unauthenticated Cross Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker can trick an administrator into performing unwanted actions.
Risk Assessment
The risk is that an attacker can change plugin settings or perform other actions on behalf of the administrator without consent, potentially leading to site takeover.
Recommendation
Update the LA-Studio Element Kit plugin to version 1.6.3 or later, which fixes this vulnerability.
Other vulnerabilities in LA-Studio Element Kit for Elementor
See all- CVE-2026-65489Medium
The LA-Studio Element Kit for Elementor plugin versions up to 1.6.2 contain an unauthenticated broken access control vulnerability. An attacker without authentication can bypass access control mechanisms.
- CVE-2026-65482Medium
The LA-Studio Element Kit for Elementor plugin versions up to 1.6.2 contain a contributor Cross Site Scripting (XSS) vulnerability. An attacker with contributor privileges can inject malicious script.
Original NVD description (English source)
Unauthenticated Cross Site Request Forgery (CSRF) in LA-Studio Element Kit for Elementor <= 1.6.2 versions.