CVE-2026-0920
Administrative User Creation Vulnerability in LA-Studio Elementor Plugin
Publication date: 2026-01-22
Last updated on: 2026-01-22
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| unknown_vendor | lastudio_element_kit | to 1.5.6.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the WordPress site is running the LA-Studio Element Kit for Elementor plugin version 1.5.6.3 or earlier. Since the vulnerability allows unauthenticated attackers to create administrative users via the 'ajax_register_handle' function by supplying the 'lakit_bkrole' parameter, detection can involve monitoring HTTP requests to the registration endpoint for this parameter or unexpected user role assignments. Specific commands could include using curl or similar tools to test the registration endpoint for the presence of the 'lakit_bkrole' parameter, for example: curl -X POST -d 'username=test&password=test&lakit_bkrole=administrator' https://example.com/wp-admin/admin-ajax.php?action=ajax_register_handle. Additionally, scanning the installed plugin versions via WP-CLI can help detect vulnerable versions: wp plugin list --format=json | grep lastudio-element-kit. However, no explicit detection commands are provided in the resources. [1, 2]
Can you explain this vulnerability to me?
This vulnerability exists in the LA-Studio Element Kit for Elementor WordPress plugin up to version 1.5.6.3. It allows unauthenticated attackers to create administrative users by exploiting the 'ajax_register_handle' function, which does not restrict the user roles that can be assigned during registration. Attackers can supply the 'lakit_bkrole' parameter to register with administrator privileges, gaining full control over the site.
How can this vulnerability impact me? :
The vulnerability can have a severe impact as it allows attackers to gain administrator access without authentication. This means they can fully control the WordPress site, including modifying content, installing malicious code, stealing data, or disrupting site operations. The CVSS score of 9.8 indicates a critical severity with high impact on confidentiality, integrity, and availability.
What immediate steps should I take to mitigate this vulnerability?
Update the LA-Studio Element Kit for Elementor plugin to version 1.6.0 or later, as this version includes fixes that prevent unauthorized administrative user creation by restricting the 'lakit_bkrole' parameter during registration. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows unauthenticated attackers to create administrative users on affected WordPress sites, potentially leading to unauthorized access and control over sensitive data. Such unauthorized access could result in violations of compliance requirements under standards like GDPR and HIPAA, which mandate strict controls over user access and protection of personal and health information. Therefore, exploitation of this vulnerability could compromise compliance with these regulations by enabling data breaches or unauthorized data manipulation.