A recently discovered vulnerability in the popular Elementor plugin for WordPress has left millions of websites exposed to a potentially devastating attack. Threat actors can exploit this cross-site request forgery (CSRF) flaw by tricking logged-in administrators into opening malicious links, allowing them to create new administrator accounts under their control.
Elementor is a widely used website builder with over 10 million installations across the web. The plugin’s drag-and-drop interface makes it easy for users to create websites without needing extensive coding knowledge. However, this ease of use has come at a cost: Elementor’s Editor Events module contains a flaw that allows attackers to bypass WordPress’s built-in security measures.
When an administrator is tricked into opening the malicious link, their authenticated session performs a REST API action permitted by their account. This can result in the creation of a new administrator account controlled by the attacker. The vulnerability affects Elementor versions 4.3.0 and 4.3.1, which are used by up to 2 million websites.
Security firm Patchstack reported the vulnerability to Elementor’s development team on September 22, after receiving it from a bug hunter known as “Saggre.” Just two days later, Elementor released a fix in version 4.3.2 of the plugin. According to Patchstack’s analysis, the CSRF flaw is caused by Elementor’s Editor Events module checking the raw request URI for the elementor/v1/events/ path and bypassing WordPress’s REST nonce validation when that string is present.
This allows attackers to append the path to requests targeting other REST endpoints and trick logged-in users into executing them with their existing privileges. The vulnerability can be exploited in one-click attacks against a logged-in administrator, creating a new attacker-controlled admin account without requiring JavaScript, an attacker-controlled webpage, or a submitted form. The link can even be delivered to the target via email, chat message, or comment on the site.
It’s worth noting that older versions of Elementor (before 4.3.0) do not contain the affected Editor Events proxy, but are still vulnerable to other flaws, some of which are already actively exploited. Users of the plugin are strongly advised to upgrade to Elementor version 4.3.2 as soon as possible to prevent attackers from triggering this bypass through the query string.
As the threat landscape continues to evolve, it’s essential for website owners and administrators to stay vigilant and keep their software up-to-date. In this case, upgrading to the latest version of Elementor is a simple yet crucial step in protecting against this potential attack vector. By taking proactive measures like this, you can help safeguard your website from the ever-present threat of cyber attacks.
Source: Bleeping Computer — 2026-09-25