Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link
Elementor CSRF in versions 4.3.0 and 4.3.1 can create admin accounts after one clicked link.
A high-severity cross-site request forgery flaw in Elementor Website Builder 4.3.0 and 4.3.1 can let an unauthenticated attacker create a WordPress administrator if a logged-in admin opens a crafted link. Patchstack rated it CVSS 8.8, and no CVE has been assigned. The plugin is active on more than 10 million sites, with the two vulnerable versions installed on more than 2 million. The issue is fixed in 4.3.2; releases before 4.3.0 are not affected.
- CSRF flaw affects Elementor 4.3.0 and 4.3.1, scored CVSS 8.8, with no CVE yet.
- Vulnerable versions are on more than two million of over 10 million installs.
- A logged-in administrator opening one link can create an attacker admin account.
- Elementor patched the issue in 4.3.2; releases before 4.3.0 are unaffected.
- Vendors
- Elementor
- Organizations
- Patchstack
From the original article
2 min read at thehackernews.com
Details have emerged about a high-severity security flaw in the Elementor Website Builder WordPress plugin that could be exploited by an unauthenticated attacker to create rogue administrator accounts and take control of a site. The cross-site request forgery (CSRF) vulnerability, which has yet to be assigned a CVE identifier, carries a CVSS score of 8. 8 out of 10.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.