What’s Vulnerable › Vulnerabilities
CVE-2026-12276: LA-Studio Element Kit for Elementor < 1.6.1 - Unauthenticated Open Registration
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-10 · updated 2026-07-10
Description
The LA-Studio Element Kit for Elementor WordPress plugin before 1.6.1 does not check whether user registration is enabled on the site before creating an account through one of its unauthenticated AJAX actions, allowing unauthenticated attackers to register new accounts even when registration has been disabled site-wide.
Affected products
- LA-Studio Element Kit for Elementor: before 1.6.1 — fixed in 1.6.1
How to fix
Upgrade to a fixed version: LA-Studio Element Kit for Elementor 1.6.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-12276 or the next vulnerability affects your stack