CVE-2026-12276 LA‑Studio CVE debrief

Who should care

Administrators of WordPress sites using the LA-Studio Element Kit for Elementor plugin should verify that they are running version 1.6.1 or later to prevent unauthorized account creation. Additionally, security teams and vulnerability management teams should review the vulnerability and plan for remediation.

Technical summary

The CVE-2026-12276 vulnerability in the LA-Studio Element Kit for Elementor WordPress plugin allows unauthenticated attackers to create new accounts on a site even when user registration is disabled. This is possible because the plugin does not check the site's registration status before allowing account creation through its AJAX actions. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. Affected administrators should update the plugin to version 1.6.1 or later and verify that user registration is disabled on their WordPress site if not intended to be used.

Defensive priority

Medium priority due to the potential for unauthorized account creation. Additional review of compensating controls and monitoring is recommended.

Recommended defensive actions

• Update the LA-Studio Element Kit for Elementor plugin to version 1.6.1 or later.
• Verify that user registration is disabled on your WordPress site if not intended to be used.
• Monitor your WordPress site for any suspicious account creation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

Evidence is based on limited information from the NVD and a source reference from WPScan. Further verification is recommended. The CVE record was published on 2026-07-10T07:16:28.203Z and has not been modified since then. The LA-Studio Element Kit for Elementor WordPress plugin before 1.6.1 does not check whether user registration is enabled on the site before creating an account through one of its unauthenticated AJAX actions, allowing unauthenticated attackers to register new accounts even when registration has been disabled site-wide. Additional verification of affected scope and vendor guidance is necessary.

Official resources