CVE-2024-37479 - Vulnerability Details - OpenCVE

Local File Inclusion vulnerability in LA-Studio LA-Studio Element Kit for Elementor via "LaStudioKit Progress Bar" widget in New Post, specifically in the "progress_type" attribute.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.3.8.1.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
La-studioweb	Element Kit For Elementor

No data.

No data.

References

Link	Providers
https://patchstack.com/database/vulnerability/lastudio-element-kit/wordpress-la-studio-element-kit-for-elementor-plugin-1-3-8-1-local-file-inclusion-vulnerability?_s_id=cve

History

Tue, 18 Mar 2025 15:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		La-studioweb La-studioweb element Kit For Elementor
Weaknesses		CWE-98
CPEs		cpe:2.3:a:la-studioweb:element_kit_for_elementor:1.3.8.1:::::wordpress::
Vendors & Products		La-studioweb La-studioweb element Kit For Elementor
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Patchstack

Published: 2024-07-02T07:40:08.888Z

Updated: 2025-03-18T14:28:47.666Z

Reserved: 2024-06-09T11:43:29.008Z

Link: CVE-2024-37479

Vulnrichment

Updated: 2024-08-02T03:57:39.382Z

NVD

Status : Awaiting Analysis

Published: 2024-07-02T08:15:06.190

Modified: 2025-03-18T15:15:50.993

Link: CVE-2024-37479

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-37479", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2024-06-09T11:43:29.008Z", "datePublished": "2024-07-02T07:40:08.888Z", "dateUpdated": "2025-03-18T14:28:47.666Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "lastudio-element-kit", "product": "LA-Studio Element Kit for Elementor", "vendor": "LA-Studio", "versions": [{"changes": [{"at": "1.3.9", "status": "unaffected"}], "lessThanOrEqual": "1.3.8.1", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Jo\u00e3o Pedro Soares de Alc\u00e2ntara (Kinorth)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Local File Inclusion vulnerability in LA-Studio LA-Studio Element Kit for Elementor via \"LaStudioKit Progress Bar\" widget in New Post, specifically in the \"progress_type\" attribute.<p>This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.3.8.1.</p>"}], "value": "Local File Inclusion vulnerability in LA-Studio LA-Studio Element Kit for Elementor via \"LaStudioKit Progress Bar\" widget in New Post, specifically in the \"progress_type\" attribute.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.3.8.1."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"description": "Local File Inclusion", "lang": "en"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2024-07-02T07:40:08.888Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/vulnerability/lastudio-element-kit/wordpress-la-studio-element-kit-for-elementor-plugin-1-3-8-1-local-file-inclusion-vulnerability?_s_id=cve"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update to 1.3.9 or a higher version."}], "value": "Update to 1.3.9 or a higher version."}], "source": {"discovery": "EXTERNAL"}, "title": "WordPress LA-Studio Element Kit for Elementor plugin <= 1.3.8.1 - Contributor+ Local File Inclusion vulnerability", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-98", "lang": "en", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')"}]}], "affected": [{"vendor": "la-studioweb", "product": "element_kit_for_elementor", "cpes": ["cpe:2.3:a:la-studioweb:element_kit_for_elementor:1.3.8.1:*:*:*:*:wordpress:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.3.8.1", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-02T14:10:11.487249Z", "id": "CVE-2024-37479", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-18T14:28:47.666Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:57:39.382Z"}, "title": "CVE Program Container", "references": [{"tags": ["vdb-entry", "x_transferred"], "url": "https://patchstack.com/database/vulnerability/lastudio-element-kit/wordpress-la-studio-element-kit-for-elementor-plugin-1-3-8-1-local-file-inclusion-vulnerability?_s_id=cve"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://patchstack.com/database/vulnerability/lastudio-element-kit/wordpress-la-studio-element-kit-for-elementor-plugin-1-3-8-1-local-file-inclusion-vulnerability?_s_id=cve", "tags": ["vdb-entry", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:57:39.382Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-37479", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-07-02T14:10:11.487249Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:la-studioweb:element_kit_for_elementor:1.3.8.1:*:*:*:*:wordpress:*:*"], "vendor": "la-studioweb", "product": "element_kit_for_elementor", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.3.8.1"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-98", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-02T14:11:58.634Z"}}], "cna": {"title": "WordPress LA-Studio Element Kit for Elementor plugin <= 1.3.8.1 - Contributor+ Local File Inclusion vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Jo\u00e3o Pedro Soares de Alc\u00e2ntara (Kinorth)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "LA-Studio", "product": "LA-Studio Element Kit for Elementor", "versions": [{"status": "affected", "changes": [{"at": "1.3.9", "status": "unaffected"}], "version": "n/a", "versionType": "custom", "lessThanOrEqual": "1.3.8.1"}], "packageName": "lastudio-element-kit", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update to 1.3.9 or a higher version.", "supportingMedia": [{"type": "text/html", "value": "Update to 1.3.9 or a higher version.", "base64": false}]}], "references": [{"url": "https://patchstack.com/database/vulnerability/lastudio-element-kit/wordpress-la-studio-element-kit-for-elementor-plugin-1-3-8-1-local-file-inclusion-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Local File Inclusion vulnerability in LA-Studio LA-Studio Element Kit for Elementor via \"LaStudioKit Progress Bar\" widget in New Post, specifically in the \"progress_type\" attribute.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.3.8.1.", "supportingMedia": [{"type": "text/html", "value": "Local File Inclusion vulnerability in LA-Studio LA-Studio Element Kit for Elementor via \"LaStudioKit Progress Bar\" widget in New Post, specifically in the \"progress_type\" attribute.<p>This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.3.8.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Local File Inclusion"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2024-07-02T07:40:08.888Z"}}}, "cveMetadata": {"cveId": "CVE-2024-37479", "state": "PUBLISHED", "dateUpdated": "2025-03-18T14:28:47.666Z", "dateReserved": "2024-06-09T11:43:29.008Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2024-07-02T07:40:08.888Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.1"}