Tuesday, August 11, 2026
LIVEThe Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///The Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///
Subscribe
Cyber Security
Independent · Digital
Thehackingpost
RSSSubscribe
CybersecurityAI-assisted

20,000 WordPress Sites Affected by Backdoor Vulnerability Allowing Malicious Admin User Creation

A critical backdoor vulnerability has been identified in the LA-Studio Element Kit for Elementor, a WordPress plugin utilized by over 20,000 active sites.

SBy Sam QuinlanJan 24, 20261 min read

A critical backdoor vulnerability has been identified in the LA-Studio Element Kit for Elementor, a WordPress plugin utilized by over 20,000 active sites.

This security flaw allows the creation of administrator accounts without authentication, posing a risk of complete site takeover.

Tracked as CVE-2026-0920, the vulnerability has a CVSS score of 9.8, categorizing it as critical and necessitating immediate action from site administrators.

The backdoor was inserted into the plugin by a former employee of LA-Studio in December 2025. The code modification enables unauthorized administrator account creation.

The issue was discovered by security researchers Athiwat Tiprasaharn, Itthidej Aramsri, and Waris Damkham on January 12, 2026, and reported through the Wordfence Bug Bounty Program.

A critical backdoor vulnerability has been identified in the LA-Studio Element Kit for Elementor, a WordPress plugin utilized by over 20,000 active sites.
Sam Quinlan · Thehackingpost

Vulnerability Name: Unauthenticated Privilege Escalation via Backdoor to Administrative User Creation CVE ID: CVE-2026-0920 CVSS Score: 9.8 (Critical) Affected Plugin: LA-Studio Element Kit for Elementor Plugin Slug: lastudio-element-kit Affected Versions: ≤ 1.5.6.3 Patched Version: 1.6.0 Active Installations: 20,000+ Attack Vector: lakit_bkrole parameter in registration request Vulnerability Type: Backdoor / Administrative User Creation Discoverers: Athiwat Tiprasaharn, Itthidej Aramsri, Waris Damkham Discovery Date: January 12, 2026 Patch Release Date: January 14, 2026 Wordfence Protection: January 13, 2026 (Premium), February 12, 2026 (Free)

The vulnerability exists in all versions up to and including 1.5.6.3. Attackers can exploit it by sending a crafted registration request containing the lakit_bkrole parameter, gaining full administrative access.

The flaw was identified within the plugin’s ajax_register_handle function and has been patched in version 1.6.0, released on January 14, 2026.

Advertisement

The backdoor operates through modifications within the plugin's registration handling system. The ajax_register_handle function contained obfuscated logic that checked for the lakit_bkrole parameter during user registration.

Upon detection, it triggered filters assigning administrator privileges to new accounts. The obfuscation used techniques like string manipulation and indirect function calls to evade detection during security audits.

Based on reporting by Cyber Security News.

AI transparency. This article was produced with the assistance of artificial intelligence and published under human editorial oversight. AI systems can make mistakes. Read how we use AI (EU AI Act, Art. 50).
Related Stories
Cybersecurity

Why Fintech Banking Platforms Are Reducing Operational Costs by 40%

Paige Monroe · Mar 26, 2026
Cybersecurity

Dogecoin Price Prediction: SHIB Burns 172M Tokens as Pepeto Exchange Earns From Every Trade

Eric Wallace · Mar 26, 2026
Cybersecurity

Solana Price Prediction: SOL Holds $86 With Commodity Status as Pepeto Targets Bigger Returns

Zachary Burns · Mar 26, 2026
Cybersecurity

Open Directory Malware Campaign Uses Obfuscated VBS, PNG Loaders and RAT Payloads

Joseph Cain · Mar 26, 2026