CVE-2026-0920 - LA-Studio Element Kit for Elementor <= 1.5.6.3 - unauthenticated privilege escala...

CVE ID : CVE-2026-0920 Published : Jan. 22, 2026, 7:15 a.m. | 37 minutes ago Description : The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Administrative User Creation in all versions up to, and including, 1.5.6.3. This is due to the 'ajax_register_handle' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'lakit_bkrole' parameter during registration and gain administrator access to the site. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...