CVE-2024-35725: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in LA-Studio Element Kit for Elementor plugin affecting versions through 1.3.6. The vulnerability was disclosed on June 6, 2024, and was assigned CVE-2024-35725. This security issue affects WordPress installations using the LA-Studio Element Kit for Elementor plugin (Patchstack).

The vulnerability is classified as a Missing Authorization (CWE-862) issue. It received a CVSS v3.1 base score of 8.8 (HIGH) from NVD with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, while Patchstack assigned a CVSS score of 4.3 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (NVD).

The vulnerability represents a broken access control issue where an unprivileged user could potentially execute certain higher privileged actions. The specific impact varies case by case, though it has been assessed with potential for high confidentiality, integrity, and availability impacts according to the NVD scoring (Patchstack).

The vulnerability requires low attack complexity and can be exploited over the network with low privileges required. No user interaction is necessary for exploitation (NVD).

Users are advised to update to version 1.3.7.4 or later to remediate this vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to a fixed version (Patchstack).