CVE-2026-0920

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Administrative User Creation in all versions up to, and including, 1.5.6.3. This is due to the 'ajax_register_handle' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'lakit_bkrole' parameter during registration and gain administrator access to the site.

• CWE-269

• https://plugins.trac.wordpress.org/browser/lastudio-element-kit/tags/1.5.6.3/includes/integrations/override.php#L301
• https://plugins.trac.wordpress.org/changeset/3439121/lastudio-element-kit
• https://www.wordfence.com/threat-intel/vulnerabilities/id/65ebc744-6cc2-47ce-b225-81820e49d59c?source=cve

Published

Jan 22, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-0913The User Submitted Posts – Enable Users to Submit Posts from…6.4
• CVE-2026-0914The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable…6.4
• CVE-2026-0915Calling getnetbyaddr or getnetbyaddr_r with a configured nss…7.5
• CVE-2026-0916The Related Posts by Taxonomy plugin for WordPress is vulner…6.4
• CVE-2026-0918The Tapo C100 v5, C220 v1 and C520WS v2 cameras’ HTTP servic…7.5
• CVE-2026-0919The HTTP parser of Tapo C210 v3, C220 v1 and C520WS v2 camer…7.5
• CVE-2026-0921Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-0924BuhoCleaner contains an insecure XPC service that allows loc…7
• CVE-2026-0925Tanium addressed an improper input validation vulnerability …4.9
• CVE-2026-0926The Prodigy Commerce plugin for WordPress is vulnerable to L…9.8
• CVE-2026-0927The KiviCare – Clinic & Patient Management System (EHR) plug…5.3
• CVE-2026-0929The RegistrationMagic WordPress plugin before 6.0.7.2 does …4.3