CVE-2026-15338: LA-Studio Elementor Path Traversal Flaw

CVE-2026-15338 Overview

CVE-2026-15338 is a Local File Inclusion (LFI) vulnerability in the LA-Studio Element Kit for Elementor plugin for WordPress. The flaw affects all versions up to and including 1.6.1 and resides in the get_type_template function. Authenticated attackers with contributor-level access or above can include and execute arbitrary .php files on the server. This enables execution of any PHP code contained in those files, allowing attackers to bypass access controls, read sensitive data, or achieve remote code execution when combined with file upload primitives. The vulnerability is tracked under [CWE-98] (Improper Control of Filename for Include/Require Statement in PHP Program).

Critical Impact
Contributor-level WordPress users can traverse the filesystem and execute arbitrary PHP files, leading to potential full site compromise.

Affected Products

LA-Studio Element Kit for Elementor plugin for WordPress
All versions up to and including 1.6.1
WordPress sites allowing contributor-level registration

Discovery Timeline

2026-07-11 - CVE-2026-15338 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-15338

Vulnerability Analysis

The vulnerability stems from unsafe path handling inside the get_type_template function within the LA-Studio Element Kit plugin. The function accepts user-controlled input intended to identify a template file and passes it through wp_normalize_path before including the resulting file. Because wp_normalize_path only normalizes directory separators, it does not resolve or reject ../ traversal sequences. Attackers can therefore construct payloads that escape the intended template directory. The extension safeguard is also ineffective because the calling code appends the required .php extension to the traversal payload before inclusion. This gives an authenticated contributor the ability to include any .php file on the server, including local logs, uploaded content, or plugin files that expose additional functionality.

Root Cause

The root cause is improper input validation of template identifiers passed to a PHP include/require construct. wp_normalize_path is used as a sanitization function despite not being designed to block path traversal. The extension check is bypassable because the caller supplies the .php suffix, so any traversal payload will satisfy the check.

Attack Vector

Exploitation requires an authenticated WordPress account with contributor privileges or higher. The attacker submits a crafted request through the plugin's progress-bar addon endpoints, providing a template value containing ../ sequences that resolve to an attacker-chosen .php file. The vulnerable code paths are documented in the WordPress plugin progress-bar addon source and the progress-bar template. Impact escalates to remote code execution when combined with any primitive that lets an attacker place a .php file on the server, such as an upload endpoint or log poisoning.

No verified public exploit code is available. Refer to the Wordfence Vulnerability Report for technical details.

Detection Methods for CVE-2026-15338

Indicators of Compromise

HTTP requests to LA-Studio Element Kit endpoints containing ../ or URL-encoded traversal sequences such as %2e%2e%2f in template parameters
Unexpected PHP execution originating from paths under wp-content/uploads/ or other writable directories
New administrator accounts, modified wp-config.php, or unfamiliar webshell files following contributor logins
WordPress access logs showing contributor-role users invoking progress-bar rendering endpoints with unusual parameters

Detection Strategies

Inspect web server and WordPress logs for requests referencing the plugin's addon or template parameters containing traversal patterns
Monitor for PHP include/require events sourced from non-plugin directories using file integrity monitoring
Correlate contributor-level authentications with subsequent template rendering requests and outbound network activity
Deploy web application firewall rules that block traversal sequences in requests targeting /wp-admin/admin-ajax.php and Elementor rendering endpoints

Monitoring Recommendations

Alert on any successful login by contributor-role accounts that have been dormant or newly created
Track filesystem changes in wp-content/plugins/lastudio-element-kit/ and wp-content/uploads/
Log and review outbound HTTP requests from the PHP process, which often indicate post-exploitation payload retrieval

How to Mitigate CVE-2026-15338

Immediate Actions Required

Update the LA-Studio Element Kit for Elementor plugin to a version above 1.6.1 as soon as the vendor publishes a fixed release referenced in the WordPress plugin change log
Audit all contributor, author, and editor accounts and disable any that are unused or unverified
Review the wp-content/uploads/ directory for unexpected .php files and remove them
Rotate WordPress administrator passwords and secret keys if compromise is suspected

Patch Information

A fix should be applied by upgrading to the latest LA-Studio Element Kit for Elementor release. Consult the WordPress plugin change log and the Wordfence Vulnerability Report to confirm the fixed version before deployment.

Workarounds

Deactivate the LA-Studio Element Kit for Elementor plugin until an updated version is installed
Disable open user registration and restrict contributor-level access to trusted individuals only
Configure the web application firewall to block path traversal patterns in requests to Elementor and LA-Studio Element Kit endpoints
Set the PHP open_basedir directive to restrict file inclusion to the WordPress installation directory

bash

# Configuration example: restrict PHP file access via open_basedir in php.ini
open_basedir = "/var/www/html/wordpress/:/tmp/"

# Disable plugin via WP-CLI until patched
wp plugin deactivate lastudio-element-kit