CVE-2026-0920-

CVE-2026-0920- LA-Studio Element Kit for Elementor 📡 漏洞利用代码最先在此发布。 在 Telegram 上关注 @KNxploited —— 获取最新披露 CVE、可用 PoC 与精准安全研究的顶尖资讯。持续更新，专为领先者打造。 🧠 概述 CVE-2026-0920 是在 LA-Studio Element Kit for Elementor WordPress 插件中发现的一个 CVSS 9.8 严重级别 漏洞。 该缺陷位于 ajaxregisterhandle 函数中，该函数通过 AJAX 处理未经认证的用户注册流程。该函数未对...

CVE-2026-0920-WordPress-LA-Studio-Exploit

CVE-2026-0920 PoC：LA-Studio Element Kit 后门漏洞利用 一个用 Go 编写的健壮的概念验证（PoC）漏洞利用程序，针对 LA-Studio Element Kit for Elementor 插件（版本 = 1.5.6.3）中的严重后门漏洞。 该工具演示了未认证攻击者如何利用 lakitajax 包装器绕过安全检查并注入恶意载荷，从而创建管理员 账户。 🚨 漏洞详情 CVE： CVE-2026-0920 类型： 权限提升 / 认证绕过 严重性： 严重（9.8/10） 攻击向量： 该插件暴露了一个处理 JSON 载荷的 AJAX...

CVE-2026-0920

漏洞研究：CVE-2026-0920 - LA-Studio Element Kit 后门 针对 LA-Studio Element Kit for Elementor（版本 ≤ 1.5.6.3）中发现的关键后门的技术分析与概念验证（PoC）。该漏洞允许未认证用户创建管理员账户。 漏洞概述 一名前雇员故意在 ajaxregisterhandle 函数中植入了一个后门，允许在注册过程中使用隐藏参数提升用户权限。 漏洞类型：授权不当 / 故意植入后门。 目标函数：ajaxregisterhandle。 后门参数：lakitbkrole。 影响：完全接管网站。 概念验证（PoC） 1...

CVE-2026-0920

CVE-2026-0920 扫描器 基于Python的扫描器，用于检测和验证WordPress站点中因使用易受攻击的LA-Studio Element 插件版本而暴露的CVE-2026-0920 漏洞。 概述 该工具旨在自动化识别可能受CVE-2026-0920 影响的WordPress目标，该漏洞涉及易受攻击的插件版本在注册流程中的不恰当角色处理。 脚本处理目标列表，尝试验证检查，并将成功结果记录到输出文件中供后续审查。 功能 多线程目标处理 自动目标规范化 AJAX nonce 提取 针对易受攻击端点的注册流程测试 成功和失败目标的结果记录 自定义邮箱/用户名/密码参数...

CVE-2026-65489

CVE-2026-65489 affects the WordPress plugin “LA-Studio Element Kit for Elementor” up to version 1.6.2. The issue is described as Unauthenticated Broken Access Control, allowing access to restricted functionality without credentials. The referenced CVSS 3.1 base score is 5.3 (MEDIUM) with network ...

EUVD-2026-48100

Unauthenticated Broken Access Control in LA-Studio Element Kit for Elementor = 1.6.2 versions...

EUVD-2026-48099

Unauthenticated Cross Site Request Forgery CSRF in LA-Studio Element Kit for Elementor = 1.6.2 versions...

CVE-2026-65488

The CVE concerns the WordPress plugin LA-Studio Element Kit for Elementor, version <= 1.6.2. It describes an unauthenticated Cross-Site Request Forgery (CSRF) that can lead to Stored XSS. The issue originates from the plugin’s handling of CSRF, enabling an attacker to trigger stored XSS withou...

EUVD-2026-48093

Contributor Cross Site Scripting XSS in LA-Studio Element Kit for Elementor = 1.6.2 versions...

CVE-2026-15338

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.1 via the gettypetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute...

CVE-2026-15338

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.1 via the gettypetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute...

CVE-2026-15338

CVE-2026-15338 concerns the LA-Studio Element Kit for Elementor plugin for WordPress. Affected: all versions up to 1.6.1. Issue: Local File Inclusion via the get_type_template function in the progress_type widget setting. Exploitation requires authenticated access at contributor level or higher, ...

CVE-2026-12276

The LA-Studio Element Kit for Elementor WordPress plugin before 1.6.1 does not check whether user registration is enabled on the site before creating an account through one of its unauthenticated AJAX actions, allowing unauthenticated attackers to register new accounts even when registration has...

CVE-2026-12276

The LA-Studio Element Kit for Elementor WordPress plugin before 1.6.1 does not check whether user registration is enabled on the site before creating an account through one of its unauthenticated AJAX actions, allowing unauthenticated attackers to register new accounts even when registration has...

WordPress Plugin 'LA Studio Element Kit for Elementor' < 1.6.0 Unauthenticated Privilege Escalation via Backdoor

The WordPress application running on the remote host has a version of the 'LA Studio Element Kit for Elementor' plugin that is prior to 1.6.0. It is, therefore, affected by an unauthenticated privilege escalation vulnerability. The plugin contains a backdoor that allows unauthenticated attackers ...

CVE-2026-24947

Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.5.6.3...

CVE-2026-24947

Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.5.6.3...

EUVD-2026-5217

Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.5.6.3...

CVE-2026-24947

The CVE-2026-24947 affects WordPress plugin LA-Studio Element Kit for Elementor (LA-Studio Element Kit). Affected versions are prior to 1.5.6.3. The issue is a broken access control due to a missing authorization check, allowing exploitation via insufficient access controls. Remediation is to upg...

WordPress plugin LA-Studio Element Kit for Elementor 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be added to a...