20,000 WordPress Sites Affected by Backdoor Vulnerability Allowing Malicious Admin User Creation

Cybersecuritynews •Tushar Subhra Dutta • January 23, 2026

A critical backdoor vulnerability has been discovered in the LA-Studio Element Kit for Elementor, a popular WordPress plugin used by more than 20,000 active sites. This security flaw allows attackers to create administrator accounts without any authentication, putting thousands of websites at risk of complete takeover. The vulnerability, tracked as CVE-2026-0920, carries a CVSS score […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

20,000 WordPress Sites Compromised by Backdoor Vulnerability A backdoor vulnerability in the LA-Studio Element Kit for Elementor has compromised over 20,000 WordPress sites, allowing attackers to create admin accounts without authentication. This vulnerability, tracked as CVE-2026-0920, poses a significant risk of complete website takeover. 3 sources 57

Extracted Entities

CVEs (1)

CVE-2026-0920

Platforms (2)

Elementor WordPress