Elementor 4.3.0 and 4.3.1: CSRF Enables Administrator Account Creation via a Flawed REST Route Check
1. Basic Information Title: Cross-Site Request Forgery in Elementor Plugin Affecting 2 Million+ Sites Source: Patchstack Published: September 25, 2026 Updated: N/A Severity: critical Severity Basis: When an authenticated administrator opens a crafted link, an attacker can create an administrator account on sites running Elementor 4.3.0 or 4.3.1 with Editor Events enabled. Patchstack rates this as…
Elementor 4.3.0 and 4.3.1, used by over two million WordPress sites, contain a Cross-Site Request Forgery (CSRF) vulnerability. This flaw allows an attacker to create a new administrator account if an administrator user unknowingly opens a specially crafted URL while logged into WordPress. Elementor's Editor Events feature partially matches REST API routes, bypassing the required nonce validation, which would otherwise prevent such unauthorized actions.
Once the new administrator account is created, the attacker can exploit the elevated privileges for further malicious activities, such as modifying site content or escalating the breach. Updating Elementor to version 4.3.2 or later is crucial to mitigate this risk.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.