CVE-2026-65489
MediumCVSS 5.3Summary
The LA-Studio Element Kit for Elementor plugin versions up to 1.6.2 contain an unauthenticated broken access control vulnerability. An attacker without authentication can bypass access control mechanisms.
Risk Assessment
An unauthorized user may gain access to sensitive functions or data, potentially leading to privilege escalation or information disclosure.
Recommendation
Immediately update the LA-Studio Element Kit plugin to the latest available version.
Other vulnerabilities in LA-Studio Element Kit for Elementor
See all- CVE-2026-65488High
The LA-Studio Element Kit for Elementor plugin version 1.6.2 and earlier has an unauthenticated Cross Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker can trick an administrator into performing unwanted actions.
- CVE-2026-65482Medium
The LA-Studio Element Kit for Elementor plugin versions up to 1.6.2 contain a contributor Cross Site Scripting (XSS) vulnerability. An attacker with contributor privileges can inject malicious script.
Original NVD description (English source)
Unauthenticated Broken Access Control in LA-Studio Element Kit for Elementor <= 1.6.2 versions.