PT-2024-16606 · WordPress · La-Studio Element Kit For Elementor
Ghsinfosec
+3
·
Published
2024-11-22
·
Updated
2025-07-12
·
CVE-2024-10873
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
LA-Studio Element Kit for Elementor plugin for WordPress versions up to, and including, 1.4.2
Description
The issue allows authenticated attackers with Contributor-level access and above to include and execute arbitrary files on the server via the
load template function. This enables the execution of any PHP code in those files, which can be used to bypass access controls, obtain sensitive data, or achieve code execution, especially in cases where images and other “safe” file types can be uploaded and included.Recommendations
For versions up to, and including, 1.4.2, consider disabling the
load template function as a temporary workaround until a patch is available. Restrict access to sensitive files and directories to minimize the risk of exploitation. Avoid uploading executable files or any files that could be used to execute malicious code. Update to a version that fixes this issue once it becomes available.Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
La-Studio Element Kit For Elementor