Full Report
Details have emerged about a high-severity security flaw in the Elementor Website Builder WordPress plugin that could be exploited by an unauthenticated attacker to create rogue administrator accounts and take control of a site. The cross-site request forgery (CSRF) vulnerability, which has yet to be assigned a CVE identifier, carries a CVSS score of 8.8 out of 10.0. It only affects versions
Analysis Summary
# Vulnerability: Elementor Website Builder CSRF REST API Bypass
## CVE Details
- **CVE ID:** Pending (Not yet assigned)
- **CVSS Score:** 8.8 (High)
- **CWE:** CWE-352 (Cross-Site Request Forgery)
## Affected Systems
- **Products:** Elementor Website Builder WordPress Plugin
- **Versions:** 4.3.0 and 4.3.1
- **Configurations:** Sites running the "Editor Events" module (introduced in 4.3.0) where an administrator or privileged user is logged into the WordPress dashboard.
## Vulnerability Description
The flaw exists in the plugin's "Editor Events" module. The module incorrectly skips CSRF protection for cookie-authenticated REST API requests whenever the string `elementor/v1/events/` is present anywhere within the request URI.
Because the request URI includes the query string, an attacker can append this specific string as a harmless parameter (e.g., `&x=elementor/v1/events/`) to any REST API request. This effectively bypasses CSRF defenses for the entire WordPress REST API surface, including WordPress core routes and routes belonging to other installed plugins.
## Exploitation
- **Status:** PoC available (detailed in research by Saggre/Patchstack).
- **Complexity:** Low (Requires only a single click on a crafted link).
- **Attack Vector:** Network (Remote). The attack can be delivered via anchor tags in emails, chat messages, or comments.
## Impact
- **Confidentiality:** High (Attacker can perform actions as the victim user).
- **Integrity:** High (Attacker can create new administrator accounts and take full control of the site).
- **Availability:** High (Attacker can modify or delete site content/configurations).
## Remediation
### Patches
- **Upgrade to Elementor version 4.3.2** or higher. This version addresses the logic flaw in the Editor Events module.
### Workarounds
- No specific software workaround provided; immediate update is the primary defense.
- **General Security Best Practice:** Avoid clicking suspicious links while logged into a WordPress administrative dashboard.
## Detection
- **Indicators of Compromise:**
- Presence of unexpected new administrator accounts (e.g., `csrfadmin`).
- Web server logs showing REST API calls to `/wp-json/wp/v2/users` or other sensitive endpoints that include the string `elementor/v1/events/` in the query parameters.
- **Detection methods and tools:**
- Monitor WordPress audit logs for unauthorized user creation or role changes.
- Security plugins like Patchstack or Wordfence may provide specific signatures for this bypass.
## References
- **Vendor Changelog:** hxxps[://]elementor[.]com/pro/changelog/
- **Original Research:** hxxps[://]patchstack[.]com/articles/cross-site-request-forgery-in-elementor-plugin-affecting-2-million-sites/
- **Security News:** hxxps[://]thehackernews[.]com/2026/09/elementor-csrf-flaw-lets-attackers-take.html