CVE-2026-12276 Overview
CVE-2026-12276 affects the LA-Studio Element Kit for Elementor WordPress plugin in versions prior to 1.6.1. The plugin exposes an unauthenticated AJAX action that creates user accounts without verifying whether the site administrator has enabled user registration. Attackers can invoke this endpoint remotely to create accounts on WordPress sites that have explicitly disabled registration site-wide. The flaw is a business logic error that undermines a security control WordPress administrators rely on to restrict access. This weakness affects the integrity of the site's user database and can serve as a foothold for further attacks against additional plugins or roles.
Critical Impact
Unauthenticated remote attackers can create WordPress accounts on sites where registration is disabled, bypassing an administrator-enforced access control.
Affected Products
- LA-Studio Element Kit for Elementor WordPress plugin versions before 1.6.1
- WordPress installations using the vulnerable plugin with registration disabled
- Any site relying on the WordPress users_can_register option as a security boundary
Discovery Timeline
- 2026-07-10 - CVE-2026-12276 published to NVD
- 2026-07-10 - Last updated in NVD database
Technical Details for CVE-2026-12276
Vulnerability Analysis
The LA-Studio Element Kit for Elementor plugin registers one or more AJAX actions accessible to unauthenticated visitors through the standard WordPress wp-admin/admin-ajax.php endpoint. One of these actions handles account creation for plugin-provided registration widgets. The handler proceeds to create a user record without first consulting the WordPress users_can_register option, which administrators toggle in Settings > General to allow or block open registration.
Because the check is missing, the plugin's registration flow operates independently of the site-wide setting. An attacker can submit a crafted POST request with the required action parameter and user data, and the plugin will provision an account regardless of the administrator's configuration. The resulting accounts default to the role configured for new users, typically subscriber, but the presence of authenticated accounts on a closed site can enable follow-on attacks against other authenticated-only endpoints or lower-privileged vulnerabilities.
Root Cause
The root cause is a missing configuration check in an unauthenticated AJAX handler. The plugin performs its own user creation logic through wp_insert_user or an equivalent function without gating that logic behind get_option('users_can_register'). This is a business logic flaw where the plugin duplicates registration functionality but omits the guard clause that core WordPress enforces.
Attack Vector
Exploitation requires only network access to the target site. An attacker sends an HTTP POST request to admin-ajax.php referencing the plugin's registration action along with attacker-controlled username, email, and password fields. No authentication, cookies, or user interaction are required. The plugin processes the request and creates the account, returning a success response that the attacker can then use to log in through the standard WordPress login page.
See the WPScan Vulnerability Report for additional technical context.
Detection Methods for CVE-2026-12276
Indicators of Compromise
- Unexpected new user accounts in wp_users on sites where registration is disabled
- POST requests to /wp-admin/admin-ajax.php referencing LA-Studio Element Kit registration actions from unauthenticated sources
- New account creation events without corresponding legitimate administrator activity
- Login events from accounts that do not match any known internal user
Detection Strategies
- Audit the WordPress user table regularly and alert on additions when users_can_register is set to 0
- Inspect web server access logs for POST requests to admin-ajax.php with plugin-specific action parameters from external IPs
- Correlate WordPress user_register hook events with the current registration setting to flag inconsistencies
Monitoring Recommendations
- Forward WordPress authentication and user management logs to a centralized logging platform
- Baseline typical admin-ajax.php traffic volume and alert on anomalous spikes tied to plugin actions
- Monitor for account creation followed by immediate login attempts from the same source IP
How to Mitigate CVE-2026-12276
Immediate Actions Required
- Update the LA-Studio Element Kit for Elementor plugin to version 1.6.1 or later
- Review the WordPress user list and delete any unauthorized accounts created since the plugin was installed
- Force password resets for existing users if unauthorized accounts are detected
- Verify the users_can_register option is set correctly in Settings > General
Patch Information
The vendor addressed CVE-2026-12276 in LA-Studio Element Kit for Elementor version 1.6.1. The fix adds a check for the users_can_register option before creating a new user through the plugin's AJAX registration action. Administrators should apply the update through the WordPress plugin dashboard or by manually replacing the plugin files.
Workarounds
- Disable the LA-Studio Element Kit for Elementor plugin until the update to 1.6.1 can be applied
- Block requests to admin-ajax.php referencing the plugin's registration action at a web application firewall
- Remove or restrict access to Elementor pages that expose the plugin's registration widget
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
