Cross-Site Request Forgery in Elementor Plugin Affecting 2 Million+ Sites
Elementor 4.3.0 and 4.3.1 have a CVSS 8.8 CSRF bug that can create a new administrator account.
Patchstack disclosed an unauthenticated cross-site request forgery flaw in Elementor Website Builder versions 4.3.0 and 4.3.1, rated CVSS 8.8. A single link opened by a logged-in WordPress user can invoke any REST API action that account may perform, including creating a second administrator if an admin clicks it. The plugin is active on more than ten million sites, and the report’s headline says more than two million are affected; releases before 4.3.0 do not include the vulnerable Editor Events proxy. Researcher Saggre reported the issue, and Patchstack has shipped mitigation rules. No CVE or observed exploitation is stated.
- Only Elementor 4.3.0 and 4.3.1 are affected; earlier releases are not.
- One clicked link can make a logged-in admin create an attacker administrator.
- Rated CVSS 8.8; no JavaScript or attacker-hosted page is required.
- A hidden Editor Events experiment is on by default for newer installs.
- Researcher Saggre reported it; Patchstack issued mitigation rules.
- Vendors
- Elementor
- Organizations
- Patchstack
From the original article
7 min read at patchstack.com
This blog post is about a Cross-Site Request Forgery vulnerability in the Elementor Website Builder plugin. One link, opened by a logged-in WordPress user, makes that user carry out any REST API action their account is permitted to perform. On a stock installation, an administrator clicking the link creates a second administrator account for the […]
By Dave Jong · patchstack.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.