A Critical Flaw in Elementor Plugin Exposes 2 Million Websites to Administrator Account Creation
A serious vulnerability has been discovered in the popular Elementor plugin, which is used by over 10 million websites on WordPress. The cross-site request forgery (CSRF) flaw allows attackers to trick a logged-in administrator into creating an attacker-controlled admin account with just one malicious link. This exploit can be delivered via email, chat message, or even a comment on the site, making it a potentially devastating attack vector.
The vulnerability affects versions 4.3.0 and 4.3.1 of the Elementor plugin, which are used by up to 2 million sites. The flaw is caused by the Editor Events module in Elementor bypassing WordPress’s REST nonce validation when a specific string is present in the request URI. This allows attackers to append malicious query parameters to requests targeting other REST endpoints, effectively tricking logged-in users into executing these requests with their existing privileges.
To exploit this vulnerability, an attacker doesn’t need to use JavaScript or have control over a webpage – all they need is a single link that can be delivered to the target. Once opened by a logged-in administrator, this link can execute any REST API action permitted by the user’s account, including creating a new admin account under the attacker’s control.
Patchstack, the security firm that discovered and reported the vulnerability to Elementor, emphasizes the severity of the flaw. “One link, opened by a logged-in WordPress user, makes that user carry out any REST API action their account is permitted to perform,” they explain. This means that users who fail to upgrade to the patched version 4.3.2 are at significant risk of having an attacker-controlled admin account created on their site.
Elementor has already released a fix for this vulnerability in version 4.3.2, which prevents attackers from triggering the bypass through the query string. Users of the plugin are strongly recommended to upgrade to this version as soon as possible to protect themselves against this exploit. While older versions of Elementor do not contain the affected Editor Events proxy, they may still be vulnerable to other flaws – some of which are already actively exploited.
The discovery of this vulnerability serves as a reminder that even popular and widely-used plugins like Elementor can have critical security flaws. As the threat landscape continues to evolve, it’s essential for website owners to stay vigilant and keep their software up-to-date with the latest patches and updates.
Source: Bleeping Computer — 2026-09-25