CVE-2026-0920: Choijun La-Studio Element Kit For Elementor

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Administrative User Creation in all versions up to, and including, 1.5.6.3. This is due to the 'ajax_register_handle' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'lakit_bkrole' parameter during registration and gain administrator access to the site.

Affected products

• Choijun La-Studio Element Kit For Elementor: up to and including 1.5.6.3

Published 2026-01-22. Last modified 2026-06-17.