Elementor WordPress flaw lets attackers create admin accounts
Elementor 4.3.0 and 4.3.1 CSRF bug lets a malicious link create WordPress admin accounts.
A CSRF flaw in Elementor Website Builder 4.3.0 and 4.3.1 can let an unauthenticated attacker trick a logged-in WordPress administrator into creating an attacker-controlled admin account. Patchstack says the Editor Events module matches elementor/v1/events/ in the raw request URI and skips WordPress REST nonce checks, so that path can be appended to other REST requests. No CVE is assigned. The affected releases are used by up to about 2 million of the plugin's 10 million active sites; Elementor patched it in 4.3.2 after a September 22 report. This bug is not described as exploited, though separate flaws in older versions are.
- CSRF in Elementor 4.3.0 and 4.3.1 can create attacker-controlled admin accounts.
- One click by a logged-in administrator is enough; no JavaScript is required.
- Up to 2 million sites run the affected versions of a 10-million-install plugin.
- Elementor fixed the issue in 4.3.2; no CVE has been assigned.
Full article412 words · extracted from bleepingcomputer.com · click to collapse
A cross-site request forgery (CSRF) vulnerability in the Elementor plugin for WordPress could allow an unauthenticated attacker to create administrator accounts.
Threat actors can exploit the flaw by tricking a logged-in administrator into opening a malicious link, causing the victim's authenticated session to perform a REST API action permitted by their account.
On default installations, the result is the creation of an administrator account under the control of the attacker.
The Elementor Website Builder is a popular WordPress plugin active on 10 million websites that lets users create websites using a drag-and-drop interface.
The CSRF flaw has yet to receive an identifier and impacts only versions 4.3.0 and 4.3.1. According to statistics from WordPress.org, the two versions are used by up to 2 million sites.
Security firm Patchstack reported the vulnerability to the Elementor team on September 22 after receiving it from bug hunter “Saggre.” Elementor released a fix two days later, in version 4.3.2 of the plugin.
According to Patchstack’s analysis, the CSRF flaw is caused by Elementor’s Editor Events module checking the raw request URI for the elementor/v1/events/ path and bypassing WordPress’s REST nonce validation when that string is present.
Because the URI also contains attacker-controlled query parameters, attackers can append the path to requests targeting other REST endpoints and trick logged-in users into executing them with their existing privileges.
Patchstack says the flaw can be abused in one-click attacks against a logged-in administrator to create a new attacker-controlled admin account.
“One link, opened by a logged-in WordPress user, makes that user carry out any REST API action their account is permitted to perform,” Patchstack explains.
The security firm says that the attack does not require JavaScript, an attacker-controlled webpage, or a submitted form, and the link can be delivered to the target via email, a chat message, or a comment on the site.
Elementor releases before 4.3.0 do not contain the affected Editor Events proxy, but those older versions are vulnerable to other flaws, some of which are already actively exploited.
Users of the plugin are recommended to upgrade to Elementor version 4.3.2 as soon as possible, which prevents attackers from triggering the bypass through the query string.
Build your security blueprint for AI-powered attacks
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.