CVE-2026-0920
CRITICAL EXPLOITEDLA-Studio Element Kit - Privilege Escalation
Title source: llmExploitation Summary
CVE-2026-0920 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 4 public exploits from researchers including John-doe-code-a11, O99099O, Galaxy-sc.
AI-analyzed exploit summary The repository contains a functional Python exploit for CVE-2026-0920, targeting a backdoor in LA-Studio Element Kit for Elementor. The exploit automates the creation of an administrator account via a crafted AJAX request with a hidden parameter.
Description
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Administrative User Creation in all versions up to, and including, 1.5.6.3. This is due to the 'ajax_register_handle' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'lakit_bkrole' parameter during registration and gain administrator access to the site.
Exploits (4)
The repository contains a functional Python exploit for CVE-2026-0920, targeting a backdoor in LA-Studio Element Kit for Elementor. The exploit automates the creation of an administrator account via a crafted AJAX request with a hidden parameter.
This repository contains a functional exploit for CVE-2026-0920, targeting LA-Studio Element Kit for Elementor versions up to 1.5.6.3. The exploit automates the creation of unauthorized administrator accounts via an unauthenticated vulnerability in the plugin's AJAX registration functionality.
This repository contains a functional Go-based exploit for CVE-2026-0920, targeting a backdoor in the LA-Studio Element Kit WordPress plugin. The exploit automates the creation of an unauthenticated admin account by injecting a malicious JSON payload into the 'lakit_ajax' endpoint.
This repository contains a functional exploit for CVE-2026-0920, targeting a vulnerability in LaStudioKit (likely a WordPress plugin). The exploit automates the extraction of an 'ajaxNonce' value and performs an unauthorized admin registration by crafting a malicious request to '/wp-admin/admin-ajax.php'.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H