CVE-2026-12276

mediumCVSS 5.3covered by 1 sourcefirst seen 2026-07-10

The LA-Studio Element Kit for Elementor WordPress plugin before 1.6.1 does not check whether user registration is enabled on the site before creating an account through one of its unauthenticated AJAX actions, allowing unauthenticated attackers to register new accounts even when registration has been disabled site-wide.

⚡ Watch CVE-2026-12276

Get an email if CVE-2026-12276 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.14% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all EPSS-scored CVEs.

Advisory coverage (1)

mediumCVE-2026-12276: The LA-Studio Element Kit for Elementor WordPress plugin before 1.6.1 does not check whether u…nvd · 2026-07-10

External references

NVD record for CVE-2026-12276

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-12276 status](https://www.csirts.com/badge/CVE-2026-12276)](https://www.csirts.com/cve/CVE-2026-12276)