Full Report
A cross-site request forgery (CSRF) vulnerability in the Elementor plugin for WordPress could allow an unauthenticated attacker to create administrator accounts. [...]
Analysis Summary
# Vulnerability: Elementor Website Builder CSRF to Remote Code Execution/Admin Creation
## CVE Details
- **CVE ID:** Pending (Not yet assigned)
- **CVSS Score:** 8.8 (Estimated - High/Critical)
- **CWE:** CWE-352 (Cross-Site Request Forgery)
## Affected Systems
- **Products:** Elementor Website Builder plugin for WordPress
- **Versions:** 4.3.0 and 4.3.1
- **Configurations:** Default installations (impacting approximately 2 million active sites).
## Vulnerability Description
The vulnerability exists within the plugin’s **Editor Events module**. The module improperly validates REST API requests by checking the raw request URI for the string `elementor/v1/events/`. If this string is present, the plugin bypasses standard WordPress REST nonce (security token) validation.
Because the module checks the entire URI—including attacker-controlled query parameters—an attacker can append this specific path to a request targeting *other* sensitive REST endpoints. If an authenticated administrator is tricked into clicking a malicious link, their session will execute the attacker's request without a valid nonce, leading to unauthorized actions such as account creation.
## Exploitation
- **Status:** PoC available (via Patchstack analysis); no active exploitation reported for this specific flaw yet (though older Elementor flaws are actively targeted).
- **Complexity:** Low (Does not require JavaScript or complex form submission).
- **Attack Vector:** Network (Social Engineering). The victim must click a link delivered via email, chat, or site comments.
## Impact
- **Confidentiality:** High (Full access to site data via new admin account)
- **Integrity:** High (Attacker can modify site content, settings, and users)
- **Availability:** High (Attacker can delete site content or lock out legitimate admins)
## Remediation
### Patches
- **Upgrade to Elementor version 4.3.2 or higher immediately.** This version implements stricter URI validation to prevent the nonce bypass via query strings.
### Workarounds
- **Session Management:** Avoid staying logged into WordPress as an Administrator while browsing other tabs or checking emails.
- **Principle of Least Privilege:** Use lower-privileged accounts for daily tasks and only log in as an administrator when necessary.
## Detection
- **Indicators of Compromise:**
- Unexpected new administrator accounts in the WordPress dashboard.
- Web server logs showing unusual requests containing `elementor/v1/events/` appended as a query parameter to other REST API endpoints (e.g., `wp-json/wp/v2/users?...elementor/v1/events/`).
- **Detection methods and tools:**
- Monitor WordPress audit logs for unauthorized user creation.
- Use security scanners like Patchstack or Wordfence to verify plugin versioning.
## References
- **Patchstack Advisory:** hxxps[://]patchstack[.]com/articles/cross-site-request-forgery-in-elementor-plugin-affecting-2-million-sites/
- **BleepingComputer Report:** hxxps[://]www[.]bleepingcomputer[.]com/news/security/elementor-wordpress-flaw-lets-attackers-create-admin-accounts/
- **WordPress Plugin Repository:** hxxps[://]wordpress[.]org/plugins/elementor/advanced/