What is the CVSS score of CVE-2026-65489?

CVE-2026-65489 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

LA-Studio Element Kit CVE-2026-65489

EUVD-2026-48100 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-2952-3jfh-mrmg

Authentication Bypass La Studio Element Kit For Elementor

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible unauthenticated endpoint with no complexity, read-only confidentiality impact, and no integrity or availability effect matches AV:N, PR:N, C:L, I:N, A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:20 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in LA-Studio Element Kit for Elementor <= 1.6.2 versions.

AnalysisAI

Broken access control in LA-Studio Element Kit for Elementor (versions ≤ 1.6.2) permits remote unauthenticated attackers to bypass authorization checks and access restricted content or plugin functionality on affected WordPress installations. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms low-complexity, unauthenticated network exploitation with a limited confidentiality impact and no data integrity or availability consequences. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Technical ContextAI

CWE-862 (Missing Authorization) describes a root cause where code executes a sensitive operation - such as returning restricted data, triggering privileged functionality, or exposing internal state - without first verifying the caller has the required capability or role. In WordPress Elementor ecosystems, add-on plugins like LA-Studio Element Kit register custom widgets, AJAX handlers, and potentially REST API routes; access control failures in these registration points commonly expose server-side callbacks to unauthenticated callers. The CPE string cpe:2.3:a:la-studio:la-studio_element_kit_for_elementor:*:*:*:*:*:*:*:* (wildcard version, WordPress context) confirms the vulnerability spans the entire release history through 1.6.2 without version-specific scoping, suggesting the missing check was present since an early release rather than introduced by a recent change.

RemediationAI

Update LA-Studio Element Kit for Elementor to the version identified as fixed in the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/lastudio-element-kit/vulnerability/wordpress-la-studio-element-kit-for-elementor-plugin-1-6-2-broken-access-control-vulnerability - a specific patched release version was not confirmed in the available intelligence and should be verified directly there before upgrading. If a patched release is not yet available, Patchstack's virtual patching feature (via the Patchstack App WAF) can block exploitation at the network layer without modifying the plugin, with the trade-off of requiring a Patchstack subscription and potential for false positives on legitimate plugin traffic. As a manual interim control, disabling the LA-Studio Element Kit plugin entirely eliminates the attack surface but also removes all associated widget functionality for site visitors; this is appropriate for high-sensitivity sites until a patch is confirmed available.