EUVD-2026-42829
GHSA-xcx5-6r38-3g5q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable unauthenticated AJAX endpoint, no interaction needed; impact is solely unauthorized account creation with no confidentiality or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The LA-Studio Element Kit for Elementor WordPress plugin before 1.6.1 does not check whether user registration is enabled on the site before creating an account through one of its unauthenticated AJAX actions, allowing unauthenticated attackers to register new accounts even when registration has been disabled site-wide.
AnalysisAI
Unauthenticated account registration bypass in the LA-Studio Element Kit for Elementor WordPress plugin (all versions before 1.6.1) allows remote, unauthenticated attackers to create WordPress user accounts on sites where site-wide registration has been explicitly disabled by the administrator. The vulnerable component is an unauthenticated AJAX action handler that omits the standard WordPress registration-status check, effectively nullifying an administrative security control. A publicly available proof-of-concept exists via WPScan, and a vendor patch is available in version 1.6.1; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Technical ContextAI
The LA-Studio Element Kit for Elementor is a WordPress plugin that extends the Elementor page builder with additional design elements. WordPress exposes AJAX endpoints at wp-admin/admin-ajax.php for both authenticated and unauthenticated callers, identified by an 'action' parameter. Plugin-defined AJAX handlers that hook into wp_ajax_nopriv_* are reachable without authentication. The vulnerable handler performs user account creation without calling the standard WordPress registration check (get_option('users_can_register')), which is the mechanism by which WordPress enforces the admin-configured 'Membership > Anyone can register' toggle. The root cause, while CWE is not formally assigned, maps most closely to CWE-862 (Missing Authorization) - the code performs a privileged operation (account creation) without verifying the site's authorization policy permits it.
RemediationAI
The primary remediation is to update the LA-Studio Element Kit for Elementor plugin to version 1.6.1 or later, which introduces the missing registration-status check in the vulnerable AJAX handler; the patch is available through the standard WordPress plugin repository. If an immediate update is not feasible, site administrators can temporarily deactivate the plugin entirely to eliminate the attack surface - note this will disable all LA-Studio Element Kit design elements rendered by Elementor on the site. As a secondary compensating control, a WAF rule blocking POST requests to wp-admin/admin-ajax.php that carry the specific vulnerable action parameter value (identifiable from the WPScan advisory at https://wpscan.com/vulnerability/0c77a001-2773-4727-a873-848f5670fb96/) can block exploitation without disabling the plugin, though this requires WAF capability and may interfere with other plugin AJAX functionality if the action parameter is shared.
Local File Inclusion in the LA-Studio Element Kit for Elementor WordPress plugin (all versions through 1.6.1) lets authe
Cross-Site Request Forgery in the LA-Studio Element Kit for Elementor WordPress plugin (versions <= 1.6.2) lets a remote
Stored Cross-Site Scripting in LA-Studio Element Kit for Elementor versions up to and including 1.6.2 allows contributor
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LinkWr
Broken access control in LA-Studio Element Kit for Elementor (versions ≤ 1.6.2) permits remote unauthenticated attackers
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today