Quick answers
- Is CVE-2026-103082 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-103082 being exploited in the wild.
- How severe is CVE-2026-103082?
- High severity, with a CVSS score of 7.2, published 1 October 2026.
- Which products and versions are affected?
- LA-Studio Element Kit for Elementor through 1.6.2.
- Is there a fix for CVE-2026-103082?
- Yes: fixed in 1.6.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-103082 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-103082?
- Check whether you run LA-Studio Element Kit for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 1.6.3
Technical details
This SSRF vulnerability in LA-Studio Element Kit for Elementor allows an authenticated attacker with contributor privileges to forge requests from the server to internal resources. The vulnerability exists in versions through 1.6.2 and can be exploited to access internal systems and exfiltrate data. Version 1.6.3 and later contain the fix.
Affected products
- LA-Studio Element Kit for Elementor through 1.6.2
Timeline
- 2026-07-17: disclosed: Reported by JunHee CHO
- 2026-10-01: advisory: Published by Patchstack
- 2026-10-01: patched