Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link
Summary: A CSRF vulnerability in the Elementor Website Builder WordPress plugin, carrying a CVSS score of 8.8 out of 10.0 and no CVE identifier yet, lets an unauthenticated attacker create rogue administrator accounts when a logged-in user opens a crafted link. The flaw affects versions 4.3.0 and 4.3.1, installed on more than 2 million sites out of the plugin's 10 million-plus installs, and stems from the Editor Events module skipping CSRF protection for cookie-authenticated REST API requests whose URI contains the string "elementor/v1/events/".
Why it matters: Patchstack says a single link opened by an administrator on a stock installation creates a second administrator account for the attacker, and the bypass covers the entire REST API surface, including WordPress core and every other installed plugin. Version 4.3.2, released this week, addresses the issue.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026