LA-Studio Element Kit vulnerabilities

Server-Side Request Forgery (SSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Server Side Request Forgery. This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2.

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 1.6.1 via the get_type_template function. This allows authenticated attackers with contributor-level access or higher to include and execute arbitrary .php files on the server.

The LA-Studio Element Kit for Elementor WordPress plugin before version 1.6.1 does not check whether user registration is enabled on the site before creating an account through one of its unauthenticated AJAX actions. This allows unauthenticated attackers to register new accounts even when registration has been disabled site-wide.