Loading vulnerability…
CVE-2026-0920 is an improper privilege management vulnerability in the LA-Studio Element Kit for Elementor WordPress plugin through version 1.5.6.3. The plugin's ajax_register_handle registration handler fails to restrict the role that may be assigned to a newly registered user. An unauthenticated attacker can supply the lakit_bkrole registration parameter with an administrator role value, causing the application to create an administrator-level WordPress account.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
6 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
The repository contains one standalone Python exploit script, CVE-2026-0920.py, rather than a framework module. It targets a claimed unauthenticated privilege-escalation/account-registration flaw in the WordPress LaStudioKit (LaKit) AJAX registration functionality. The script normalizes supplied target URLs, disables TLS certificate verification, rotates among a small set of browser User-Agent strings, and probes several public frontend paths for an ajaxNonce embedded in JavaScript or HTML data attributes. It then sends a crafted request to WordPress's /wp-admin/admin-ajax.php endpoint with action=lakit_ajax and the recovered nonce. The request is designed to set registration fields and abuse LaKit role/meta-related fields to obtain wp_capabilities administrator privileges. The script supports a single URL, a file of targets, interactive operation, and multithreaded processing up to 50 threads. It logs activity through a queue-backed printer and writes successful target results to success_results.txt. The exploit contains a basic, hardcoded administrator-account payload, so it is assessed as operational rather than weaponized. The filename supplies the CVE identifier, but no independent CVE validation or vulnerable version range is included in the provided code.
This repository is a small standalone Python exploit/scanner for CVE-2026-0920 affecting WordPress sites using vulnerable LA-Studio Element plugin versions. The repo contains only three files: an MIT LICENSE, a README describing usage as a scanner, and the main script cve2026_0920.py. Despite the README emphasizing scanning/validation, the code goes beyond passive detection and actively attempts exploitation by creating a new privileged account. The script structure is typical of a threaded batch exploitation tool: it parses CLI arguments, reads a target list, normalizes target URLs, extracts an AJAX nonce from several likely public pages, submits a crafted registration request to /wp-admin/admin-ajax.php, and then verifies success by logging into /wp-login.php with the supplied credentials. It uses requests sessions, randomized User-Agent strings, disabled TLS verification, multithreading via threading and Queue, and synchronized result logging to an output file. The main exploit capability is abuse of the plugin's AJAX registration flow. The crafted payload sets action=lakit_ajax and embeds a register action with attacker-controlled email, username, and password fields, plus role-related parameters including lakit_bkrole="1". This strongly indicates privilege escalation or unauthorized administrator-account creation through improper role handling. The verification stage attempts WordPress authentication using the newly created credentials, confirming whether exploitation succeeded. Fingerprintable targets/endpoints include the WordPress paths /wp-admin/admin-ajax.php and /wp-login.php, as well as several public pages probed for nonce extraction: /, /index.php, /home, /start, /?page_id=1, and /?p=1. Local artifacts include success_results.txt and list.txt. Default credentials embedded in the script are admin@cve0920.com / @dminDxe / dxeTHT, though these can be overridden by CLI options or interactive input. Overall, this is an operational exploit tool rather than a pure detector: it performs active registration attempts and credential validation at scale against batches of WordPress targets.
Repository contains a single Python exploit script (CVE-2026-0920.py), a custom license, and a detailed README. The Python script is a multithreaded operational exploit targeting a claimed unauthenticated privilege-escalation flaw in the WordPress plugin LA-Studio Element Kit for Elementor <= 1.5.6.3. Its workflow is: normalize target URLs, request several public front-end paths to scrape an exposed ajax nonce from HTML/JavaScript, then send a crafted registration request to /wp-admin/admin-ajax.php using action=lakit_ajax and attacker-controlled registration fields. The exploit is designed to create a new administrator account with hardcoded default credentials, verify success, and save successful targets to success_results.txt. The script supports bulk targeting from a list file, randomized User-Agent headers, disabled TLS verification, and concurrent worker threads. The README mirrors the exploit logic and explains the vulnerable parameter (lakit_bkrole) and the intended attack chain. Overall, this is a real exploit implementation rather than a detector or README-only repository.
Repository contains a single Python PoC exploit script for CVE-2026-0920 targeting the WordPress plugin “LA-Studio Element Kit for Elementor” (<= 1.5.6.3). The exploit abuses an intentional backdoor parameter (`lakit_bkrole`) in the plugin’s registration AJAX handler to create a new user with Administrator privileges. Structure: - `CVE-2026-0920.py`: Main exploit. Uses `requests.Session()` and sends a POST to `{target}/wp-admin/admin-ajax.php` with `action=lakit_ajax`, a user-supplied `_nonce`, and an `actions` parameter containing a JSON string that triggers `register` and sets `lakit_bkrole` to `administrator`. Supports custom User-Agent and an optional Cookie header. TLS verification is disabled (`verify=False`). - `README.md`: Technical description, exploitation steps (notably nonce acquisition), and an example command. - `requeriments.txt`: Python dependencies. - `LICENSE`: MIT. Exploit capability and outcome: - Primary capability: unauthenticated administrative account creation (full site takeover) by registering a new user and forcing role escalation via `lakit_bkrole=administrator`. - Prerequisite: a valid WordPress AJAX nonce for the `lakit_ajax` action (the PoC does not include nonce discovery; it must be obtained separately). Notable implementation details: - Endpoint targeted is the standard WordPress AJAX handler `/wp-admin/admin-ajax.php`. - Success detection is simplistic (checks for '"success":true' and '200' in response body rather than HTTP status code), but the core request construction reflects the described backdoor trigger.
Repository purpose: a Python-based “mass exploiter” for a claimed WordPress plugin vulnerability (CVE-2026-0920) in “LA-Studio Element Kit for Elementor” (<= 1.5.6.3), aiming to create an administrator account without authentication. Structure: - CVE-2026-0920.py: main exploit tool (threaded scanner/exploiter). Implements banner display, target ingestion, WordPress detection, plugin indicator checks, vulnerability verification, credential generation, exploitation attempt, and optional login verification. Uses requests with SSL verification disabled and rotates User-Agent strings. - README.md: usage instructions, ethical warning, feature list, and examples. - Baner.txt: ASCII art banner. - url.txt: placeholder example target URL. - LICENSE/.gitignore: standard. Exploit capabilities (from code/README): - Mass target processing with configurable threads/timeouts. - WordPress fingerprinting via GET requests to common WP paths (/wp-login.php, /wp-admin/, /readme.html, /wp-includes/, /xmlrpc.php). - Plugin presence heuristics via keyword indicators (la-studio-element-kit, element-kit, lakit, lastudio). - Auto-generation of credentials (username/email/password) and reporting. - Writes results to VLUN.txt (vulnerable) and VLUN_V.txt (verified exploited with credentials). Notes/limitations: - The provided code excerpt is truncated at the core exploitation logic, but the surrounding scaffolding and README clearly indicate the intended outcome: unauthenticated admin creation via a plugin AJAX endpoint and subsequent login verification. No hardcoded C2 infrastructure is present; targets are user-supplied URLs.
Repository contains a Go-based exploit PoC for CVE-2026-0920 affecting the WordPress plugin “LA-Studio Element Kit for Elementor” (lastudio-element-kit) <= 1.5.6.3. The exploit performs an unauthenticated privilege escalation by creating a new WordPress user with Administrator role. Structure: - CVE-2026-0920.go: Standalone Go program (main package) implementing the exploit end-to-end. - Recon/scrape phase: Issues an HTTP GET to a user-supplied page URL (typically a register/login page containing the plugin widget) and extracts required nonce values using regexes: "ajaxNonce" (global) and "lakit-register-nonce" (register). It also attempts to extract the correct AJAX endpoint from "ajaxUrl"/"ajax_url" in the page source. - Target endpoint selection: Uses scraped ajax URL if present; otherwise guesses /wp-admin/admin-ajax.php (with a special-case guess for paths containing /vuln-site/). - Exploit delivery: Sends an HTTP POST to admin-ajax.php with form fields action=lakit_ajax, _nonce=<globalNonce>, and actions=<JSON>. The JSON encodes a “register” action whose data includes the hidden backdoor field lakit_bkrole set to "administrator" along with username/email/password and the register nonce. - Success check: Treats HTTP 200 plus response containing "success":true or "type":"success" as successful account creation and prints the created credentials. - Transport behavior: Disables TLS certificate verification (InsecureSkipVerify=true) and uses a 15s timeout. - README.md: Usage instructions and vulnerability description; confirms the intended effect is unauthenticated admin account creation via lakit_ajax and lakit_bkrole. Overall purpose/capabilities: - Automates nonce discovery and AJAX endpoint discovery from a target page. - Exploits the plugin’s backdoor registration handler by injecting lakit_bkrole=administrator to create an admin user without authentication. - Provides configurable target URL and credentials via CLI flags (-u, -user, -email, -pass) and supports manual nonce override (-nonce, -rnonce).
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical vulnerability exposing a WordPress REST endpoint that permits creation of an administrator account, as demonstrated by the supplied Nuclei proof of concept. The content associates the issue with version 1.5.6.3 but does not identify the affected plugin or product.
Unknown
An unauthenticated administrative user creation / privilege escalation vulnerability in the LA-Studio Element Kit for Elementor WordPress plugin, caused by insufficient restriction of user role selection during AJAX registration, allowing attackers to create an administrator account.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.