Elementor WordPress flaw lets attackers create admin accounts
Elementor 4.3.0 and 4.3.1 CSRF bug lets a malicious link create WordPress admin accounts.
A CSRF flaw in Elementor Website Builder 4.3.0 and 4.3.1 can let an unauthenticated attacker trick a logged-in WordPress administrator into creating an attacker-controlled admin account. Patchstack says the Editor Events module matches elementor/v1/events/ in the raw request URI and skips WordPress REST nonce checks, so that path can be appended to other REST requests. No CVE is assigned. The affected releases are used by up to about 2 million of the plugin's 10 million active sites; Elementor patched it in 4.3.2 after a September 22 report. This bug is not described as exploited, though separate flaws in older versions are.
- CSRF in Elementor 4.3.0 and 4.3.1 can create attacker-controlled admin accounts.
- One click by a logged-in administrator is enough; no JavaScript is required.
- Up to 2 million sites run the affected versions of a 10-million-install plugin.
- Elementor fixed the issue in 4.3.2; no CVE has been assigned.
- Vendors
- Elementor
- Organizations
- PatchstackElementor
From the original article
2 min read at bleepingcomputer.com
A cross-site request forgery (CSRF) vulnerability in the Elementor plugin for WordPress could allow an unauthenticated attacker to create administrator accounts. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.