Executive Summary

This vulnerability exists in the LA-Studio Element Kit for Elementor WordPress plugin up to version 1.5.6.3. It allows unauthenticated attackers to create administrative users by exploiting the 'ajax_register_handle' function, which does not restrict the user roles that can be assigned during registration. Attackers can supply the 'lakit_bkrole' parameter to register with administrator privileges, gaining full control over the site.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can have a severe impact as it allows attackers to gain administrator access without authentication. This means they can fully control the WordPress site, including modifying content, installing malicious code, stealing data, or disrupting site operations. The CVSS score of 9.8 indicates a critical severity with high impact on confidentiality, integrity, and availability.

Useful 0 Not Useful 0

Mitigation Strategies

Update the LA-Studio Element Kit for Elementor plugin to version 1.6.0 or later, as this version includes fixes that prevent unauthorized administrative user creation by restricting the 'lakit_bkrole' parameter during registration. [1]

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to create administrative users on affected WordPress sites, potentially leading to unauthorized access and control over sensitive data. Such unauthorized access could result in violations of compliance requirements under standards like GDPR and HIPAA, which mandate strict controls over user access and protection of personal and health information. Therefore, exploitation of this vulnerability could compromise compliance with these regulations by enabling data breaches or unauthorized data manipulation.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the WordPress site is running the LA-Studio Element Kit for Elementor plugin version 1.5.6.3 or earlier. Since the vulnerability allows unauthenticated attackers to create administrative users via the 'ajax_register_handle' function by supplying the 'lakit_bkrole' parameter, detection can involve monitoring HTTP requests to the registration endpoint for this parameter or unexpected user role assignments. Specific commands could include using curl or similar tools to test the registration endpoint for the presence of the 'lakit_bkrole' parameter, for example: curl -X POST -d 'username=test&password=test&lakit_bkrole=administrator' https://example.com/wp-admin/admin-ajax.php?action=ajax_register_handle. Additionally, scanning the installed plugin versions via WP-CLI can help detect vulnerable versions: wp plugin list --format=json | grep lastudio-element-kit. However, no explicit detection commands are provided in the resources. [1, 2]

Useful 0 Not Useful 0