CVE-2026-0920
LA-Studio Element Kit for Elementor <= 1.5.6.3 - Unauthenticated Privilege Escalation via Backdoor to Administrative User Creation via lakit_bkrole parameter
CRITICAL 9.8EPSS 1.1%
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Administrative User Creation in all versions up to, and including, 1.5.6.3. This is due to the 'ajax_register_handle' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'lakit_bkrole' parameter during registration and gain administrator access to the site.
- Affected
- choijun · LA-Studio Element Kit for Elementor
- CVSS v3.1 WORDFENCE
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 1.11% chance of exploitation in the next 30 days, 65th percentile
- Published
- 2026-01-22
- Updated
- 2026-04-08
Proof-of-concept exploits (5)
- John-doe-code-a11/CVE-2026-09207★ · 2026-01-28
- Galaxy-sc/CVE-2026-0920-WordPress-LA-Studio-Exploit2★ · 2026-01-22
- Nxploited/CVE-2026-0920-3★ · 2026-04-18
- Dx3iZ/CVE-2026-09200★ · 2026-07-06
- katranSefa/CVE-2026-09200★ · 2026-09-02