Galaxy-sc/CVE-2026-0920-WordPress-LA-Studio-Exploit

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Go-based exploit for CVE-2026-0920 that sends a crafted AJAX request to a vulnerable WordPress plugin to create an administrator account. It scrapes nonces and the AJAX URL from the target, constructs a JSON payload with 'lakit_bkrole' set to 'administrator', and sends it to the admin-ajax.php endpoint.

Backdoor review

No backdoor observed in reviewed code

The supplied Go source code and README implement a public proof-of-concept exploit for CVE-2026-0920. The code sends a crafted HTTP POST request to a target WordPress site to create an administrator account via the documented vulnerability. No concealed backdoor, unrelated payload, credential exfiltration, persistence mechanism, or operator-directed harm was observed. The artifact's behavior is consistent with its stated purpose.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagesgo
Target softwareWordPressLA-Studio Element Kit for Elementor
Attack typesprivilege escalationauthentication bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively constructs and sends a malicious request to create an administrator account on a vulnerable target, which is the definition of an exploit. It does not merely detect or report the vulnerability.

CVE-2026-0920.go:3-4CVE-2026-0920.go:203-215README.md:3-5

Requirements

  • Target URL of a page where the vulnerable LA-Studio Element Kit plugin is active and exposes the lakit_ajax action.CVE-2026-0920.go:105
  • Valid nonces (ajaxNonce and lakit-register-nonce) must be obtainable from the target page or provided manually.CVE-2026-0920.go:146-150

Observed behavior

  • Scrapes the target page to extract the global nonce, register nonce, and the admin-ajax.php URL.CVE-2026-0920.go:135CVE-2026-0920.go:247-296
  • Constructs a JSON payload containing a 'register' action with 'lakit_bkrole' set to 'administrator'.CVE-2026-0920.go:178-195
  • Sends an HTTP POST request to the discovered admin-ajax.php endpoint with the action 'lakit_ajax' and the malicious JSON payload.CVE-2026-0920.go:203-215
  • Checks the response for success indicators (e.g., '"success":true') to confirm administrator account creation.CVE-2026-0920.go:230
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Sends HTTP POST to admin-ajax.php with action=lakit_ajax and a JSON payload containing lakit_bkrole=administratorThis is the documented exploit mechanism for CVE-2026-0920, matching the vulnerability description.CVE-2026-0920.go:203-206CVE-2026-0920.go:192
Network Communication
HTTP GET to target URL to scrape nonces and ajax URLStandard reconnaissance step for a PoC exploit; no data exfiltration to third parties.CVE-2026-0920.go:135CVE-2026-0920.go:247-296
Author Contact
Telegram: t.me/Dread_NetContact information displayed in the banner; not a backdoor indicator.CVE-2026-0920.go:93
Review boundaries

What the analysis did not establish

  • One non-text media file (CVE-2026-0920.PNG) was not analyzed; it is a screenshot referenced in the README.
  • The evidence does not include the vulnerable plugin source code; analysis is based solely on the exploit code and its description.
  • One non-text media file (CVE-2026-0920.PNG) was present in the artifact but not analyzed; it is a screenshot referenced in the README and is unlikely to contain executable backdoor behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1