The vulnerability is a missing authorization flaw in the LA‑Studio Element Kit for Elementor WordPress plugin. Attackers who can reach the plugin’s administration pages may obtain access to restricted settings or data that should be limited to privileged users. The flaw is a classic missing or incorrect access control, identified as CWE‑862, and could expose configuration information or modify content without proper permissions.

WordPress installations using the LA‑Studio Element Kit for Elementor plugin with versions prior to 1.5.6.3 are affected. The impact applies to all users who can interact with the plugin’s administrative interface in those versions.

The CVSS score of 4.3 indicates a low‑to‑medium severity, and the EPSS score of less than 1% suggests a very low probability of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through exploitation of improperly configured access control within the plugin’s admin area; it is inferred that an adversary would need access to a user account in the WordPress installation that has sufficient privileges to view or modify the plugin’s settings, unless the plugin itself accepts unauthenticated requests to privileged endpoints.