CVE-2026-0920-

CVE-2026-0920- LA-Studio Element Kit for Elementor 📡 The exploit drops here first. Follow @KNxploited on Telegram — your elite feed for freshly disclosed CVEs, working PoCs, and precision security research. Updated relentlessly. Built for those who stay ahead. 🧠 Overview CVE-2026-0920 is a CVSS 9...

CVE-2026-0920

漏洞研究：CVE-2026-0920 - LA-Studio Element Kit 后门 针对 LA-Studio Element Kit for Elementor（版本 ≤ 1.5.6.3）中发现的关键后门的技术分析与概念验证（PoC）。该漏洞允许未认证用户创建管理员账户。 漏洞概述 一名前雇员故意在 ajaxregisterhandle 函数中植入了一个后门，允许在注册过程中使用隐藏参数提升用户权限。 漏洞类型：授权不当 / 故意植入后门。 目标函数：ajaxregisterhandle。 后门参数：lakitbkrole。 影响：完全接管网站。 概念验证（PoC） 1...

CVE-2026-0920-WordPress-LA-Studio-Exploit

CVE-2026-0920 PoC：LA-Studio Element Kit 后门漏洞利用 一个用 Go 编写的健壮的概念验证（PoC）漏洞利用程序，针对 LA-Studio Element Kit for Elementor 插件（版本 = 1.5.6.3）中的严重后门漏洞。 该工具演示了未认证攻击者如何利用 lakitajax 包装器绕过安全检查并注入恶意载荷，从而创建管理员 账户。 🚨 漏洞详情 CVE： CVE-2026-0920 类型： 权限提升 / 认证绕过 严重性： 严重（9.8/10） 攻击向量： 该插件暴露了一个处理 JSON 载荷的 AJAX...

EUVD-2026-48100

Unauthenticated Broken Access Control in LA-Studio Element Kit for Elementor = 1.6.2 versions...

EUVD-2026-48099

Unauthenticated Cross Site Request Forgery CSRF in LA-Studio Element Kit for Elementor = 1.6.2 versions...

CVE-2026-65488

The CVE concerns the WordPress plugin LA-Studio Element Kit for Elementor, version <= 1.6.2. It describes an unauthenticated Cross-Site Request Forgery (CSRF) that can lead to Stored XSS. The issue originates from the plugin’s handling of CSRF, enabling an attacker to trigger stored XSS withou...

CVE-2026-65482

The CVE-2026-65482 entry concerns the WordPress LA-Studio Element Kit for Elementor plugin, affected in versions

CVE-2026-15338

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.1 via the gettypetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute...

CVE-2026-15338

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.1 via the gettypetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute...

CVE-2026-15338

CVE-2026-15338 concerns the LA-Studio Element Kit for Elementor plugin for WordPress. Affected: all versions up to 1.6.1. Issue: Local File Inclusion via the get_type_template function in the progress_type widget setting. Exploitation requires authenticated access at contributor level or higher, ...

CVE-2026-15338: Improper Control of Filename for Include/Require Statement in PHP Program

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.1 via the gettypetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute...

WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by PRISM - Wordfence in WordPress Plugin LA-Studio Element Kit for Elementor versions = 1.6.1...

CVE-2026-12276

The LA-Studio Element Kit for Elementor WordPress plugin before 1.6.1 does not check whether user registration is enabled on the site before creating an account through one of its unauthenticated AJAX actions, allowing unauthenticated attackers to register new accounts even when registration has...

CVE-2026-12276 LA-Studio Element Kit for Elementor < 1.6.1 - Unauthenticated Open Registration

The LA-Studio Element Kit for Elementor WordPress plugin before 1.6.1 does not check whether user registration is enabled on the site before creating an account through one of its unauthenticated AJAX actions, allowing unauthenticated attackers to register new accounts even when registration has...

CVE-2026-12276

The LA-Studio Element Kit for Elementor WordPress plugin before 1.6.1 does not check whether user registration is enabled on the site before creating an account through one of its unauthenticated AJAX actions, allowing unauthenticated attackers to register new accounts even when registration has...

WordPress Plugin 'LA Studio Element Kit for Elementor' < 1.6.0 Unauthenticated Privilege Escalation via Backdoor

The WordPress application running on the remote host has a version of the 'LA Studio Element Kit for Elementor' plugin that is prior to 1.6.0. It is, therefore, affected by an unauthenticated privilege escalation vulnerability. The plugin contains a backdoor that allows unauthenticated attackers ...

CVE-2026-24947

Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.5.6.3...

EUVD-2026-5217

Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.5.6.3...

CVE-2026-24947

Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.5.6.3...

CVE-2026-24947

The CVE-2026-24947 affects WordPress plugin LA-Studio Element Kit for Elementor (LA-Studio Element Kit). Affected versions are prior to 1.5.6.3. The issue is a broken access control due to a missing authorization check, allowing exploitation via insufficient access controls. Remediation is to upg...