The LA-Studio Element Kit for Elementor contains a Server-Side Request Forgery (SSRF) vulnerability identified as CVE-2026-103082. This flaw exists in versions from initial release through 1.6.2 and enables attackers to cause the server to make unauthorized requests. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope change, and low confidentiality and integrity impacts without availability impact.

Successful exploitation of this SSRF vulnerability could allow an attacker to make the vulnerable server perform unintended requests, potentially accessing internal resources or sensitive information. The impact includes limited confidentiality and integrity loss but no availability impact as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates and consider applying any recommended temporary mitigations if provided.