CVE-2026-0920: Privilege Escalation in LA-Studio Element Kit

The impact of CVE-2026-0920 is severe. An attacker can exploit this vulnerability to gain complete control over a WordPress site by creating an administrator account without authentication. This grants them full access to all site data, including sensitive user information, financial records, and administrative configurations. They could modify content, install malicious plugins, redirect traffic, or even completely compromise the server. This vulnerability shares similarities with other WordPress plugin vulnerabilities where improper input validation leads to unauthorized access.

1. Reserved2026-01-13
2. Published2026-01-22
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-0920 is to immediately upgrade the LA-Studio Element Kit for Elementor plugin to version 1.6.0 or later. If upgrading is not immediately feasible, consider temporarily disabling the plugin to prevent exploitation. As a short-term workaround, implement strict user role management policies within WordPress to limit the potential impact of a successful attack. Monitor WordPress access logs for suspicious user registration attempts, particularly those involving unusual role assignments. After upgrading, verify the fix by attempting to register a user with an unauthorized role (e.g., 'lakit_bkrole=administrator') and confirming that the registration fails.

Active installs

10KKnown

Plugin rating