# CVE-2026-103082: LA-Studio Element Kit for Elementor server-side request forgery

Source: https://junglewise.ai/threats/cve-2026-103082-server-side-request-forgery-ssrf-vulnerability-in-la-studio-la  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-01. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-103082 · Severity: high · CVSS 7.2 · Published 2026-10-01

LA-Studio Element Kit is a WordPress plugin that extends the Elementor page builder with additional design elements. A server-side request forgery vulnerability allows attackers with contributor-level access to make the server connect to internal systems and leak sensitive data from behind the firewall, such as internal APIs or databases.

Technologies: [LA-Studio Element Kit for Elementor](https://junglewise.ai/threats/technologies/element-kit-for-elementor). Vendors: [LA-Studio](https://junglewise.ai/threats/vendors/la-studio).

## Quick answers

**Is CVE-2026-103082 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103082 being exploited in the wild.

**How severe is CVE-2026-103082?** High severity, with a CVSS score of 7.2, published 1 October 2026.

**Which products and versions are affected?** LA-Studio Element Kit for Elementor through 1.6.2.

**Is there a fix for CVE-2026-103082?** Yes: fixed in 1.6.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-103082 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-103082?** Check whether you run LA-Studio Element Kit for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.6.3

## Technical details

This SSRF vulnerability in LA-Studio Element Kit for Elementor allows an authenticated attacker with contributor privileges to forge requests from the server to internal resources. The vulnerability exists in versions through 1.6.2 and can be exploited to access internal systems and exfiltrate data. Version 1.6.3 and later contain the fix.

## Affected products

- LA-Studio Element Kit for Elementor through 1.6.2

## Timeline

- 2026-07-17: disclosed: Reported by JunHee CHO
- 2026-10-01: advisory: Published by Patchstack
- 2026-10-01: patched

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/lastudio-element-kit/vulnerability/wordpress-la-studio-element-kit-for-elementor-plugin-1-6-2-server-side-request-forgery-ssrf-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/lastudio-element-kit/vulnerability/wordpress-la-studio-element-kit-for-elementor-plugin-1-6-2-server-side-request-forgery-ssrf-vulnerability?_s_id=cve)

## Related threats

- [LA-Studio Element Kit for Elementor broken access control](https://junglewise.ai/threats/cve-2026-65489-la-studio-element-kit-for-elementor-broken-access-control)
- [LA-Studio Element Kit for Elementor CSRF to Stored XSS](https://junglewise.ai/threats/cve-2026-65488-la-studio-element-kit-for-elementor-csrf-to-stored-xss)
- [LA-Studio Element Kit for Elementor Contributor XSS](https://junglewise.ai/threats/cve-2026-65482-la-studio-element-kit-for-elementor-contributor-xss)
- [LA-Studio Element Kit for Elementor unauthenticated account registration](https://junglewise.ai/threats/cve-2026-12276-la-studio-element-kit-for-elementor-unauthenticated-account)