Executive brief
The LA-Studio Element Kit for Elementor, a WordPress plugin used to enhance website design, contains a security flaw that allows unauthorized users to create new accounts. This occurs even if the website administrator has explicitly disabled user registration. While new accounts typically have limited permissions, this could lead to an influx of spam accounts and provide a foothold for further attacks on the site.
Technical details
The LA-Studio Element Kit for Elementor plugin fails to validate the WordPress 'users_can_register' setting within its AJAX registration handler. An unauthenticated attacker can exploit this by sending a crafted POST request to the 'lakit_ajax' action with registration data. The attack requires a valid 'lakit_ajax' nonce, which can be retrieved from any public page where the plugin's login or registration widget is active. Successful exploitation results in the creation of a new user account with default site privileges. This issue is fixed in version 1.6.1.
Affected products
- LA-Studio LA-Studio Element Kit for Elementor < 1.6.1
Timeline
- 2026-06-19: disclosed: Publicly published on WPScan
- 2026-06-19: patched: Fixed in version 1.6.1
- 2026-07-10: advisory: CVE published to NVD