This vulnerability (CVE-2024-35725) in LA-Studio Element Kit for Elementor is due to missing authorization controls, categorized under CWE-862. It affects all versions up to 1.3.6, allowing users with some privileges to potentially access or perform actions they should not be authorized to. The CVSS 3.1 base score is 4.3, reflecting network attack vector, low complexity, requiring privileges, no user interaction, unchanged scope, with limited confidentiality impact and no impact on integrity or availability. No patch or official remediation has been announced by the vendor as of the publication date.

The vulnerability could allow an attacker with some level of privileges to bypass authorization checks, potentially leading to unauthorized access to certain features or data within the plugin. The impact is limited to confidentiality with no known effects on integrity or availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and restrict user privileges carefully to minimize exposure. Monitor for vendor updates or patches addressing this vulnerability.