CVE-2026-0920: 
WordPress vulnerability analysis and mitigation

CVE-2026-0920 is an unauthenticated administrative user creation vulnerability (commonly described as a backdoor) in the LA-Studio Element Kit for Elementor WordPress plugin. It affects all versions up to and including 1.5.6.3, and was published on January 22, 2026, by Wordfence. The flaw allows any unauthenticated attacker to register as a WordPress administrator by supplying a crafted parameter during registration. It carries a CVSS v3.1 base score of 9.8 (Critical), assigned by Wordfence (Wordfence, NVD).

The root cause is classified as CWE-269 (Improper Privilege Management). The vulnerable ajax_register_handle function in includes/integrations/override.php (line 301) processes user registration requests without validating or restricting the lakit_bkrole parameter, which controls the role assigned to the new user. An unauthenticated attacker can supply lakit_bkrole=administrator (or equivalent) in a registration request, causing WordPress to create a new account with full administrative privileges. No authentication, special configuration, or user interaction is required (Wordfence, WordPress Trac).

Successful exploitation grants an attacker full WordPress administrator access without any prior credentials, resulting in complete compromise of confidentiality, integrity, and availability of the affected site. An attacker can read all site data (including user credentials and private content), modify or delete content, install malicious plugins or themes, create persistent backdoors, and potentially pivot to the underlying server if further vulnerabilities exist. Approximately 20,000 WordPress sites using the affected plugin versions are exposed to this risk (Wordfence Blog, SecurityOnline).

Multiple public proof-of-concept exploits have been published on GitHub, including repositories by adriangigliotti (CVE-2026-666), O99099O, John-doe-code-a11, and Nxploited (Feedly). A Nuclei template pull request has also been submitted to the projectdiscovery repository, further lowering the exploitation barrier. The vulnerability has been described as exploited in the wild, with media coverage referencing active compromise of WordPress sites. The EPSS score is approximately 0.026% (low automated exploitation probability), and it does not appear in the CISA KEV catalog as of the time of reporting. Qualys has published detection signatures (IDs 733630 and 530874) (Qualys).

1. Reconnaissance: Identify WordPress sites running the LA-Studio Element Kit for Elementor plugin (versions ≤ 1.5.6.3) using tools like WPScan, Shodan, or by checking /wp-content/plugins/lastudio-element-kit/ for version indicators.
2. Locate the vulnerable endpoint: The plugin registers an AJAX handler (ajax_register_handle) accessible via WordPress's standard AJAX endpoint (/wp-admin/admin-ajax.php or the front-end equivalent), typically triggered with the action parameter set to the plugin's registration action.
3. Craft the malicious registration request: Send an HTTP POST request to the AJAX endpoint including standard registration fields (username, email, password) and append the lakit_bkrole=administrator parameter to assign the administrator role.
4. Submit the request: The server processes the registration without validating the role parameter, creating a new WordPress user account with administrator privileges.
5. Authenticate and take control: Log in to the WordPress admin dashboard (/wp-admin/) using the newly created administrator credentials to gain full site control, install backdoor plugins, exfiltrate data, or perform further actions (Wordfence Blog, WordPress Trac).

• Network: Unexpected POST requests to /wp-admin/admin-ajax.php or front-end AJAX endpoints containing the lakit_bkrole parameter; unusual registration traffic from unknown or foreign IP addresses.
• Logs: WordPress access logs showing POST requests with lakit_bkrole=administrator in the body; new user creation events in WordPress debug or audit logs for accounts not created by legitimate administrators.
• WordPress Admin: Presence of unexpected administrator-level user accounts in the WordPress Users panel, especially accounts with generic or randomized usernames/emails created at unusual times.
• File System: Newly installed plugins or themes not authorized by site administrators; presence of web shells or PHP backdoor files in the wp-content/uploads/ or plugin directories.
• Process: Unusual PHP processes spawning shell commands or making outbound network connections from the web server process (Wordfence Blog).

Update the LA-Studio Element Kit for Elementor plugin to a version higher than 1.5.6.3, which includes the fix that restricts role assignment in the ajax_register_handle function (see the patch changeset at WordPress Trac). If an update is not immediately available, disable or remove the plugin until a patched version can be installed. Site administrators should audit all WordPress user accounts and remove any unauthorized administrator accounts. Additionally, deploying a Web Application Firewall (WAF) rule to block POST requests containing the lakit_bkrole parameter can serve as a temporary mitigation (Wordfence, Wordfence Blog).

Wordfence published a detailed blog post describing the vulnerability as a "backdoor" affecting approximately 20,000 WordPress sites and urging immediate updates (Wordfence Blog). The story was picked up by multiple security news outlets including The Hacker News (in its weekly recap), GBHackers, CyberSecurityNews, eSecurity Planet, and SecurityOnline, amplifying awareness of the critical risk. Social media discussion appeared on Bluesky and Mastodon/Infosec.exchange, with security researchers highlighting the ease of exploitation. CISA included the vulnerability in its weekly vulnerability bulletin (SB26-026) (CISA).