Nxploited/CVE-2026-0920-

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that exploits CVE-2026-0920 by sending a crafted AJAX request to create an administrator account on vulnerable WordPress sites, then verifies the created account by logging in and accessing the plugin installation page.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python exploit script (CVE-2026-0920.py) and a README.md for CVE-2026-0920. The script performs the documented exploit: it extracts a public nonce, sends a crafted AJAX request to create an administrator account on vulnerable WordPress sites, and verifies the resulting admin access. No concealed executable behavior, unrelated payload, credential exfiltration to an external party, persistence mechanism, or operator-directed harm beyond the stated exploit was observed. The script writes success results to a local file and prints to the terminal; it does not transmit credentials to any remote server. The README describes the same exploit and contains no hidden instructions.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareLA-Studio Element Kit for ElementorWordPress
Attack typesPrivilege EscalationUnauthenticated Admin Creation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a Python script that actively sends a crafted HTTP request to a target to create an administrator account, which is the definition of an exploit. The script's main function, lakit_register_admin, constructs and sends the malicious payload, and the verify_full_admin function confirms the resulting privilege escalation.

CVE-2026-0920.py:136-198CVE-2026-0920.py:202-315

Requirements

  • Target must be running a vulnerable version of the LA-Studio Element Kit for Elementor plugin (<= 1.5.6.3).README.md:40
  • The target's front-end HTML must expose a valid ajaxNonce.CVE-2026-0920.py:81-132

Observed behavior

  • Extracts a publicly accessible ajaxNonce from the target site's front-end HTML.CVE-2026-0920.py:81-132
  • Sends a POST request to /wp-admin/admin-ajax.php with action=lakit_ajax and a JSON payload containing attacker-controlled credentials and the parameter lakit_bkrole=1 to trigger administrator role assignment.CVE-2026-0920.py:136-198
  • Verifies the created administrator account by logging into /wp-login.php and confirming access to /wp-admin/plugin-install.php.CVE-2026-0920.py:202-315
  • Writes successful exploitation results, including target URL and credentials, to a file named success_results.txt.CVE-2026-0920.py:381-388
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Credential Handling
ADMIN_EMAIL, ADMIN_PASSWORD, ADMIN_USERNAME constantsCredentials are used only in the exploit request and local result file; no exfiltration to external server observed.CVE-2026-0920.py:24-26CVE-2026-0920.py:136-198CVE-2026-0920.py:381-388
Network Communication
POST to /wp-admin/admin-ajax.php and /wp-login.phpAll network requests target the supplied victim site; no calls to external command-and-control or exfiltration endpoints.CVE-2026-0920.py:157-198CVE-2026-0920.py:202-315
Author Contact
Telegram @KNxploited, GitHub NxploitedContact information present in script and README; no evidence of hidden communication channels.CVE-2026-0920.py:20-21README.md:14-15
Review boundaries

What the analysis did not establish

  • The evidence includes a README.md file and a Python script. A third file, list.txt, is referenced but its content is not included in the evidence packets.
  • The analysis is based solely on the provided source code and documentation; the code was not executed, and its effectiveness is not verified.
  • One file (unclassified, 1505 bytes) was flagged as binary and not analyzed; its content is unknown.
  • The review is static; dynamic behavior or network traffic was not observed.
  • The script imports standard libraries only; no third-party dependency analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1