CVE-2024-35725: Element Kit for Elementor Auth Bypass

CVE-2024-35725 Overview

CVE-2024-35725 is a missing authorization vulnerability [CWE-862] in the LA-Studio Element Kit for Elementor WordPress plugin. The flaw affects all versions of the plugin up to and including 1.3.6. An authenticated attacker with low privileges can leverage this broken access control weakness to reach functionality that should be restricted, leading to compromise of confidentiality, integrity, and availability. The vulnerability is exploitable over the network without user interaction, making WordPress sites running the affected plugin exposed to privilege abuse from any authenticated account.

Critical Impact
Authenticated low-privileged users can bypass authorization checks in the LA-Studio Element Kit for Elementor plugin, enabling actions that impact the confidentiality, integrity, and availability of WordPress installations.

Affected Products

LA-Studio Element Kit for Elementor plugin for WordPress
All versions from n/a through 1.3.6
WordPress sites using the vulnerable plugin as an Elementor extension

Discovery Timeline

2024-06-10 - CVE-2024-35725 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-35725

Vulnerability Analysis

The vulnerability is classified as Missing Authorization under [CWE-862]. The LA-Studio Element Kit for Elementor plugin exposes functionality without verifying that the requesting user possesses the required capability or role. Because authorization is checked improperly (or not at all), an authenticated attacker holding a low-privileged account, such as a subscriber, can invoke restricted operations.

Successful exploitation impacts all three security properties. Attackers can read data they should not access, modify plugin or site state, and disrupt availability of the affected functionality. The network-accessible nature of WordPress admin-ajax and REST endpoints amplifies exposure across any internet-facing site running the plugin.

Root Cause

The root cause is the absence of a capability check on one or more plugin actions. WordPress plugins typically enforce authorization using current_user_can() or nonce and capability validation within AJAX and REST handlers. In vulnerable versions of the LA-Studio Element Kit for Elementor plugin, these checks are missing or insufficient, allowing any authenticated session to reach protected code paths.

Attack Vector

An attacker registers or obtains a low-privileged WordPress account on the target site. The attacker then sends crafted HTTP requests to the plugin endpoints exposed via admin-ajax.php or the REST API. Because the plugin fails to validate authorization, the requests execute successfully. Refer to the Patchstack Vulnerability Database Entry for technical details on the affected handlers.

Detection Methods for CVE-2024-35725

Indicators of Compromise

Unexpected requests to LA-Studio Element Kit AJAX actions or REST routes originating from low-privileged user sessions
Unauthorized modifications to Elementor templates, widgets, or plugin configuration entries
Creation of new administrative or editor accounts following subscriber-level activity spikes
Anomalous outbound traffic from the WordPress host after plugin endpoint access

Detection Strategies

Inventory WordPress installations and identify sites running LA-Studio Element Kit for Elementor at version 1.3.6 or earlier
Review web server access logs for POST requests to plugin-specific admin-ajax.php actions from non-administrator accounts
Correlate plugin endpoint access with subsequent changes to WordPress options, users, or post metadata
Use file integrity monitoring on the wp-content/plugins/lastudio-element-kit/ directory to detect tampering

Monitoring Recommendations

Enable WordPress audit logging to record capability changes, user role modifications, and plugin option updates
Forward web server and WordPress logs to a centralized SIEM for correlation and long-term retention
Alert on newly created WordPress accounts that gain elevated privileges within short time windows
Monitor for scanning behavior targeting known LA-Studio plugin endpoints across the perimeter

How to Mitigate CVE-2024-35725

Immediate Actions Required

Update the LA-Studio Element Kit for Elementor plugin to a version above 1.3.6 as soon as a fixed release is available
Restrict new user registration on WordPress sites that do not require public signups
Audit existing user accounts and remove unused or unrecognized low-privileged accounts
Review recent changes to Elementor templates, widgets, and plugin settings for signs of tampering

Patch Information

The vulnerability affects LA-Studio Element Kit for Elementor from unspecified initial versions through 1.3.6. Administrators should consult the Patchstack Vulnerability Database Entry and the plugin vendor's release notes for the fixed version and upgrade guidance.

Workarounds

Deactivate and remove the LA-Studio Element Kit for Elementor plugin until a patched version is deployed
Deploy a web application firewall rule to block unauthenticated and low-privileged access to the plugin's AJAX and REST endpoints
Enforce strong authentication and multi-factor authentication for all WordPress accounts to reduce the population of accounts an attacker can compromise
Restrict access to /wp-admin/ and /wp-json/ from untrusted networks where operationally feasible

bash

# Example: block requests to the vulnerable plugin path at the web server
# Apache .htaccess snippet
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{REQUEST_URI} ^/wp-content/plugins/lastudio-element-kit/ [NC]
  RewriteRule .* - [F,L]
</IfModule>