CVE-2026-15338
Received Received - Intake

Local File Inclusion in LA-Studio Element Kit for Elementor Plugin

Publication date: 2026-07-11

Last updated on: 2026-07-11

Assigner: Wordfence

Description
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.1 via the get_type_template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The wp_normalize_path function used in get_template only normalizes directory separators and does not resolve or reject path traversal sequences, while the extension check is trivially bypassed because the caller already appends the required extension to the traversal payload.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-11
Last Modified
2026-07-11
Generated
2026-07-11
AI Q&A
2026-07-11
EPSS Evaluated
N/A
NVD
CVE-2026-15338
EUVD
EUVD-2026-43126

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
la-studio element_kit_for_elementor to 1.6.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The LA-Studio Element Kit for Elementor plugin for WordPress has a Local File Inclusion (LFI) vulnerability in all versions up to and including 1.6.1. This vulnerability exists in the get_type_template function, which allows authenticated users with contributor-level access or higher to include and execute arbitrary PHP files on the server.

The issue arises because the wp_normalize_path function only normalizes directory separators but does not prevent path traversal sequences. Additionally, the extension check can be bypassed since the required extension is appended after the traversal payload, enabling attackers to execute any PHP code they upload.

Compliance Impact

This vulnerability allows authenticated attackers with contributor-level access to execute arbitrary PHP code on the server, potentially bypassing access controls and obtaining sensitive data.

Such unauthorized access and potential data exposure could lead to violations of data protection regulations like GDPR and HIPAA, which require strict controls over sensitive data and system access.

Therefore, exploitation of this vulnerability may result in non-compliance with these standards due to compromised confidentiality, integrity, and availability of protected information.

Impact Analysis

This vulnerability can have serious impacts including bypassing access controls, obtaining sensitive data, and executing arbitrary PHP code on the server.

  • Attackers with contributor-level access or higher can execute malicious PHP files.
  • It can lead to unauthorized access to sensitive information.
  • It can result in full code execution on the affected server, potentially compromising the entire system.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15338. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart