Critical · published January 22, 2026
🚨 An unauthenticated attacker can register as an admin, and that’s a game-changer! 🔥 Think of it like a party with a bouncer who doesn’t check IDs — anyone can just walk in and claim to be the host. That's exactly what's happening with the LA-Studio Element Kit for Elementor plugin! If exploited, this vulnerability grants attackers full control over your WordPress site. They could delete posts, manipulate content, or even install malicious code, potentially leading to a total takeover of your online presence. This is absolutely devastating!
Think of it like a party with a bouncer who doesn’t check IDs — anyone can just walk in and claim to be the host. That's exactly what's happening with the LA-Studio Element Kit for Elementor plugin! The vulnerability lies in the 'ajax_register_handle' function, which fails to restrict the user roles during registration. This oversight allows unauthenticated users to specify the 'lakit_bkrole' parameter, enabling them to create accounts with administrative privileges.
If exploited, this vulnerability grants attackers full control over your WordPress site. They could delete posts, manipulate content, or even install malicious code, potentially leading to a total takeover of your online presence. This is absolutely devastating! To mitigate this risk, update the LA-Studio Element Kit plugin to version 1.5.6.4 or later immediately. Additionally, review user roles and permissions regularly to ensure no unauthorized changes have been made. Conduct a security audit of your site to ensure everything is shipshape! You've got this! With a few simple updates, you can keep your site secure and thriving! 🛡️