This vulnerability (CVE-2024-37479) is a Local File Inclusion issue in the LA-Studio Element Kit for Elementor plugin, affecting versions through 1.3.8.1. It arises from improper handling of the "progress_type" attribute in the "LaStudioKit Progress Bar" widget, allowing an attacker with low privileges to include local files on the server. The CVSS 3.1 base score is 8.5, indicating high impact with network attack vector, high confidentiality, integrity, and availability impacts, and requiring low privileges but high attack complexity. No official patch or remediation level has been published by the vendor as of the data provided.

Successful exploitation could allow an attacker to read sensitive local files, potentially leading to disclosure of sensitive information, code execution, or full system compromise. The CVSS score of 8.5 reflects high impact on confidentiality, integrity, and availability. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable widget or plugin version to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.