Technical impact
The LA‑Studio Element Kit for Elementor plugin allows unauthenticated users to create accounts with any role through the 'ajax_register_handle' function. By supplying the 'lakit_bkrole' parameter, an attacker can invoke this endpoint to add a new administrator without being logged in, granting full control over the WordPress site. The vulnerability arises from the absence of role validation, enabling creation of privileged accounts that bypass normal security checks.
Affected Systems
This flaw affects the WordPress plugin LA‑Studio Element Kit for Elementor distribution from the vendor choijun. All releases up to and including version 1.5.6.3 are impacted, regardless of the WordPress core or theme configuration.
Risk and Exploitability
The CVSS score of 9.8 classifies this issue as Critical, with an EPSS of 1% indicating low but nonzero likelihood of exploitation. The bug is not listed in the CISA KEV catalog. Attackers can trigger the vulnerability via an unauthenticated POST request to the plugin’s AJAX endpoint, supplying an arbitrary value for 'lakit_bkrole', typically 'administrator'. No privileged access or network restrictions are required, making this a straightforward privilege escalation route.
