CVE-2026-65488
Deferred Deferred - Pending Action

Unauthenticated CSRF in LA-Studio Element Kit for Elementor

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: Patchstack

Description
Unauthenticated Cross Site Request Forgery (CSRF) in LA-Studio Element Kit for Elementor <= 1.6.2 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-08-12
AI Q&A
2026-07-23
EPSS Evaluated
2026-08-11
NVD
CVE-2026-65488
EUVD
EUVD-2026-48099

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
la-studio element_kit_for_elementor to 1.6.2 (inc)
la-studio element_kit to 1.6.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Unauthenticated Cross Site Request Forgery (CSRF) in the LA-Studio Element Kit for Elementor plugin versions up to and including 1.6.2. CSRF allows attackers to trick users into executing unwanted actions on a web application where they are authenticated, without their knowledge or consent.

Detection Guidance

Detecting this CSRF vulnerability requires checking for outdated versions of the LA-Studio Element Kit plugin. Inspect your WordPress installation for the plugin version. If it is <= 1.6.2, the system is vulnerable. No specific commands are provided in the context, but you can use WordPress admin panel or file system checks to verify the plugin version.

Impact Analysis

This vulnerability could allow attackers to perform unauthorized actions on your website if you are using a vulnerable version of the LA-Studio Element Kit for Elementor. These actions could include modifying content, changing settings, or taking administrative actions without your knowledge.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it is classified as low severity with no significant threat. The CSRF vulnerability requires user interaction and has limited impact on data integrity or confidentiality.

Mitigation Strategies

Update LA-Studio Element Kit for Elementor to the latest version (1.6.2 or higher) to patch the CSRF vulnerability. If an update is not available, consider disabling the plugin temporarily until a fix is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65488. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart