LA-Studio Element Kit EUVD-2026-90747

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication or user interaction is required: a remote unauthenticated attacker can trigger the SSRF against any site running LA-Studio Element Kit for Elementor version 1.6.2 or earlier. The limiting factors are that the target WordPress site must have this specific Elementor add-on plugin installed and active at a vulnerable version, and realistic impact depends on reachable internal services or metadata endpoints behind the server; the exact plugin feature or request parameter that performs the server-side fetch is not specified in the available Patchstack reference and should be confirmed against the vendor advisory.

The CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) from Patchstack indicates a network-exploitable, low-complexity SSRF that per the vector requires NO authentication (PR:N) and no user interaction, with a scope change (S:C) and low confidentiality and integrity impact. Despite the HIGH 7.2 rating, the real-world priority is tempered: there is no EPSS score provided, the issue is NOT in CISA KEV, and no public proof-of-concept is referenced - the status is no public exploit identified at time of analysis. The PR:N (unauthenticated) rating is notable and somewhat atypical for Patchstack-reported WordPress add-on SSRFs, many of which require authenticated access; the single Patchstack reference does not detail the exploitable endpoint, so this unauthenticated assumption should be verified against the vendor advisory. Overall this is a genuine but moderate-risk SSRF - meaningful because SSRF against WordPress plugins is a common pivot (internal network scanning, cloud metadata access), but currently showing no evidence of active or automated exploitation.

An attacker sends a crafted request to a vulnerable LA-Studio Element Kit endpoint that fetches a user-supplied URL server-side, coercing the WordPress server to make outbound requests to attacker-chosen internal or external destinations. This can be used to probe internal services, reach cloud instance metadata endpoints, or relay requests through the trusted server. No public proof-of-concept is referenced, and per CVSS the attack is network-based and low-complexity with no authentication required.