Loading vulnerability…
Unauthenticated Administrator Account Creation in LA-Studio Element Kit for Elementor
CVE-2026-0920 is an improper privilege management vulnerability in the LA-Studio Element Kit for Elementor WordPress plugin through version 1.5.6.3. The plugin's ajax_register_handle registration handler fails to restrict the role that may be assigned to a newly registered user. An unauthenticated attacker can supply the lakit_bkrole registration parameter with an administrator role value, causing the application to create an administrator-level WordPress account.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation gives an unauthenticated remote attacker administrative control of the affected WordPress site. An attacker can use the created administrator account to modify site configuration and content, manage users and plugins, access sensitive administrative data, and potentially execute code through administrative WordPress functionality.
If you can’t patch tonight, do this now.
Disable or restrict public user registration until the plugin is remediated. Apply compensating WAF controls to reject registration requests containing the lakit_bkrole parameter. Where operationally feasible, restrict access to WordPress administrative and login interfaces using IP allowlisting or equivalent access controls.
Patch, then assume compromise.
Update LA-Studio Element Kit for Elementor to a version later than 1.5.6.3 when a vendor-fixed release is available. If no fixed release is available, disable or remove the plugin and use an alternative. Review WordPress user accounts and remove unauthorized administrator accounts, then rotate credentials and secrets that may have been accessible to an administrator.
6 exploits validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.