Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link
Elementor CSRF in versions 4.3.0 and 4.3.1 can create admin accounts after one clicked link.
A high-severity cross-site request forgery flaw in Elementor Website Builder 4.3.0 and 4.3.1 can let an unauthenticated attacker create a WordPress administrator if a logged-in admin opens a crafted link. Patchstack rated it CVSS 8.8, and no CVE has been assigned. The plugin is active on more than 10 million sites, with the two vulnerable versions installed on more than 2 million. The issue is fixed in 4.3.2; releases before 4.3.0 are not affected.
- CSRF flaw affects Elementor 4.3.0 and 4.3.1, scored CVSS 8.8, with no CVE yet.
- Vulnerable versions are on more than two million of over 10 million installs.
- A logged-in administrator opening one link can create an attacker admin account.
- Elementor patched the issue in 4.3.2; releases before 4.3.0 are unaffected.
Full article406 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananSep 26, 2026Vulnerability / Web Security
Details have emerged about a high-severity security flaw in the Elementor Website Builder WordPress plugin that could be exploited by an unauthenticated attacker to create rogue administrator accounts and take control of a site.
The cross-site request forgery (CSRF) vulnerability, which has yet to be assigned a CVE identifier, carries a CVSS score of 8.8 out of 10.0. It only affects versions 4.3.0 and 4.3.1 of the plugin, which is active on over 10 million WordPress sites. Statistics from WordPress.org show that the two impacted versions alone have been installed on more than 2 million sites.
"One link, opened by a logged-in WordPress user, makes that user carry out any REST API action their account is permitted to perform," Patchstack said. "On a stock installation, an administrator clicking the link creates a second administrator account for the attacker."
The WordPress security company said the attack does not hinge on any prerequisite, such as JavaScript, a submitted form, or a web page under the threat actor's control. The link can even be a plain anchor tag embedded in an email, a chat message, or a comment.
Following responsible disclosure, the issue has been addressed in version 4.3.2 released earlier this week. A security researcher going by the alias "Saggre" has been credited with discovering and reporting the bug.
Patchstack said the vulnerability stems from the Editor Events module skipping CSRF protection for cookie-authenticated REST API requests every time the literal string "elementor/v1/events/" appears anywhere in the request URI.
"Because the request URI includes the query string, and the query string is written by whoever composes the link, any REST request can opt itself out of that protection by appending a harmless-looking parameter," it added.
The bypass applies to the entire REST API surface of a site, including WordPress core routes and the routes of every other plugin installed on it. An attacker could exploit this loophole to create an administrator account through "/wp/v2/users" using a request like below -
https://example.com/wp-json/wp/v2/users
?_method=POST
&username=csrfadmin
&email=csrfadmin%40example.test
&password=...
&roles%5B%5D=administrator
&x=elementor/v1/events/Because Elementor releases before 4.3.0 do not ship the Editor Events proxy, they are not affected by the flaw. Users of the plugin are advised to apply the latest update as soon as possible to counter any potential threat.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.