LA-Studio Element Kit for Elementor <= 1.4.2 - Authenticated (Contributor+) Local File Inclusion

CVE-2024-10873

Summary

The LA-Studio Element Kit for Elementor plugin for WordPress is susceptible to a Local File Inclusion vulnerability through the _load_template function. Authenticated attackers with Contributor-level access can leverage this vulnerability to include and execute arbitrary files stored on the server. This may lead to the execution of PHP code within these files, which poses significant risks such as the potential bypass of access controls, exposure of sensitive data, or unauthorized code execution under certain conditions, allowing the inclusion of apparently 'safe' files like images.

References