CVE-2026-0920 is an improper privilege management vulnerability (CWE-269) in the LA-Studio Element Kit for Elementor WordPress plugin. The flaw exists in the 'ajax_register_handle' function, which fails to restrict the user roles that can be assigned during registration. This allows unauthenticated attackers to supply the 'lakit_bkrole' parameter and register accounts with administrative privileges. The vulnerability affects all versions up to and including 1.5.6.3. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker to create an administrative user account on the affected WordPress site. This grants full control over the site, including the ability to modify content, install plugins, change configurations, and potentially compromise the entire hosting environment. The impact is critical due to the complete loss of site security and control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the registration functionality or disable the vulnerable plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.