CVE-2024-10873 is a Local File Inclusion vulnerability (CWE-98) in the LA-Studio Element Kit for Elementor WordPress plugin, affecting all versions up to 1.4.2. The vulnerability arises from improper control of filenames in the _load_template function, allowing authenticated attackers with Contributor-level privileges or higher to include arbitrary files on the server. This can lead to execution of arbitrary PHP code, enabling attackers to bypass access controls, access sensitive data, or execute code remotely. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows authenticated users with Contributor or higher privileges to execute arbitrary PHP code on the server. This can result in bypassing WordPress access controls, unauthorized data disclosure, and full remote code execution, severely compromising the affected system's confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and monitor for suspicious activity related to file inclusion attempts. Avoid uploading or including files that could be used to exploit this vulnerability.