Elementor (Product): news timeline & CVEs

Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link

Elementor CSRF in versions 4.3.0 and 4.3.1 can create admin accounts after one clicked link.

A high-severity cross-site request forgery flaw in Elementor Website Builder 4.3.0 and 4.3.1 can let an unauthenticated attacker create a WordPress administrator if a logged-in admin opens a crafted link. Patchstack rated it CVSS 8.8, and no CVE has been assigned. The plugin is active on more than 10 million sites, with the two vulnerable versions installed on more than 2 million. The issue is fixed in 4.3.2; releases before 4.3.0 are not affected.

The Hacker NewsSep 26, 09:55 UTC · 1d agoVulnerability 3 sources

Elementor WordPress flaw lets attackers create admin accounts

Elementor 4.3.0 and 4.3.1 CSRF bug lets a malicious link create WordPress admin accounts.

A CSRF flaw in Elementor Website Builder 4.3.0 and 4.3.1 can let an unauthenticated attacker trick a logged-in WordPress administrator into creating an attacker-controlled admin account. Patchstack says the Editor Events module matches elementor/v1/events/ in the raw request URI and skips WordPress REST nonce checks, so that path can be appended to other REST requests. No CVE is assigned. The affected releases are used by up to about 2 million of the plugin's 10 million active sites; Elementor patched it in 4.3.2 after a September 22 report. This bug is not described as exploited, though separate flaws in older versions are.

BleepingComputerupdated Sep 26, 09:55 UTC · 1d agofirst Sep 25, 18:13 UTC · 1d agoVulnerability 3 sources

Cross-Site Request Forgery in Elementor Plugin Affecting 2 Million+ Sites

Elementor 4.3.0 and 4.3.1 have a CVSS 8.8 CSRF bug that can create a new administrator account.

Patchstack disclosed an unauthenticated cross-site request forgery flaw in Elementor Website Builder versions 4.3.0 and 4.3.1, rated CVSS 8.8. A single link opened by a logged-in WordPress user can invoke any REST API action that account may perform, including creating a second administrator if an admin clicks it. The plugin is active on more than ten million sites, and the report’s headline says more than two million are affected; releases before 4.3.0 do not include the vulnerable Editor Events proxy. Researcher Saggre reported the issue, and Patchstack has shipped mitigation rules. No CVE or observed exploitation is stated.

Patchstackupdated Sep 26, 09:55 UTC · 1d agofirst Sep 25, 09:31 UTC · 2d agoVulnerability 3 sources

Elementor

Timeline3 articles

Appears with

Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link

Elementor WordPress flaw lets attackers create admin accounts

Cross-Site Request Forgery in Elementor Plugin Affecting 2 Million+ Sites