CVE-2024-5349: LFI in LA-Studio Element Kit for Elementor

The impact of CVE-2024-5349 is significant due to the potential for remote code execution. An attacker who can successfully exploit this vulnerability can upload seemingly harmless files (like images) and then include them via the 'map_style' parameter, effectively executing arbitrary PHP code. This could allow them to gain full control of the WordPress site, steal sensitive data (user credentials, database information), modify website content, or even install malware. The ability to bypass access controls and execute code makes this a particularly dangerous vulnerability, similar in impact to other LFI vulnerabilities that have led to complete system compromise.

1. Reserved2024-05-25
2. Published2024-07-02
3. Modified2024-08-01
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-5349 is to upgrade to a patched version of the LA-Studio Element Kit for Elementor plugin as soon as it becomes available. Until a patch is released, consider restricting file upload permissions to prevent attackers from uploading files they can later include. Implement strict input validation on the 'map_style' parameter to prevent malicious input. Web Application Firewalls (WAFs) configured to detect and block attempts to include arbitrary files can also provide a layer of protection. Monitor WordPress logs for suspicious activity, such as attempts to access unusual files or execute PHP code from unexpected locations.