CVE-2026-15338: LA-Studio Element Kit Authenticated LFI Vulnerability

Vulnerability Overview Vulnerability Name: LA-Studio Element Kit for Elementor <= 1.6.1 - Authenticated (Contributor+) Local File Inclusion via 'progress_type' Widget Setting CVE ID: CVE-2026-15338 CVSS Score: 7.5 (High) Release Date: July 10, 2026 Last Updated: July 11, 2026 Researcher: PRISM Scope Software Type: Plugin Software Slug: lastudio-element-kit Patch Available: Yes Affected Versions: <= 1.6.1 Fixed Version: 1.6.2 Remediation Recommendation: Update to version 1.6.2 or later patched versions Vulnerability Description This vulnerability allows an authenticated attacker (with Contributor-level privileges) to execute arbitrary PHP files via the function in versions 1.6.1 and earlier, resulting in Local File Inclusion (LFI). Attackers can leverage this vulnerability to bypass access controls, obtain sensitive information, or execute code. References plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Related Recent Vulnerabilities CVE-2026-0920: LA-Studio Element Kit for Elementor <= 1.5.6.3 - Unauthenticated Privilege Escalation via Backdoor to Administrative User Creation via iakkt_bkrole parameter CVE-2026-24947: LA-Studio Element Kit for Elementor <= 1.5.6.3 - Missing Authorization CVE-2025-8360: LA-Studio Element Kit for Elementor <= 1.5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets CVE-2025-4944: LA-Studio Element Kit for Elementor <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Compare and Google Maps Widgets CVE-2025-4943: LA-Studio Element Kit for Elementor <= 1.5.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-link-element-link Parameter CVE-2025-3106: LA-Studio Element Kit for Elementor <= 1.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table of Contents Widget CVE-2025-32194: LA-Studio Element Kit for Elementor <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-10787: LA-Studio Element Kit for Elementor <= 1.4.4 - Authenticated (Contributor+) Post Disclosure CVE-2024-10873: LA-Studio Element Kit for Elementor <= 1.4.2 - Authenticated (Contributor+) Local File Inclusion CVE-2024-47628: LA-Studio Element Kit for Elementor <= 1.3.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting Additional Information Copyright: 2012-2026 Defiant Inc. License: This vulnerability information may be copied, prepared derivative works, publicly displayed, publicly performed, and distributed under a perpetual, worldwide, non-exclusive, royalty-free, irrevocable copyright license from Defiant. MITRE Corporation: This vulnerability information may be copied, prepared derivative works, publicly displayed, publicly performed, and distributed under a perpetual, worldwide, non-exclusive, royalty-free, irrevocable copyright license from MITRE Corporation. Contact Information Technical Support: 9am-8pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays. Response Time: 24-hour support, 365 days a year, 1-hour response time. Other Links Terms of Service: Link Privacy Policy and Notice at Collection: Link Do Not Sell or Share My Personal Information: Link Social Media X: Link Facebook: Link Instagram: Link YouTube: Link Products and Support Products: - Wordfence Free - Wordfence Premium - Wordfence Care - Wordfence Response - Wordfence CLI - Wordfence Intelligence - Wordfence Central Support: - Documentation - Learning Center - Free Support - Premium Support News: - Blog - In The News - Vulnerability Advisories About: - About Wordfence - Affiliate Program - Employment - Contact - Security - CVE Request Form Subscription Stay Updated: Register to receive news and updates from our team of experienced security professionals. Email: Input Box Agree to Terms: Checkbox Register: Button Copyright © 2012-2026 Defiant Inc. All Rights Reserved Others CRESCENT: Link

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-15338: LA-Studio Element Kit Authenticated LFI Vulnerability

More from this source