Elementor WordPress Flaw Lets Attackers Create Admin Accounts

Elementor CSRF Flaw Lets Attackers Create Rogue WordPress Admin Accounts

A cross-site request forgery (CSRF) vulnerability in the Elementor Website Builder plugin for WordPress, tracked as CVE-2026-62062 (CVSS 8.8), allowed an unauthenticated attacker to create a fully privileged administrator account with nothing more than a single clicked link. The flaw affects Elementor versions 4.3.0 and 4.3.1, releases that together run on an estimated 2 million of the plugin's roughly 10 million active WordPress installations. Security firm Patchstack reported the bug to the Elementor team on September 22, 2026, and Elementor shipped a fix in version 4.3.2 just two days later, on September 24, 2026.

Incident at a Glance

How It Worked

A Nonce Bypass Hidden in a Raw URL Check

According to Patchstack's technical writeup, the root cause sits in Elementor's Editor Events module. That module checks whether the raw incoming request URI contains the string elementor/v1/events/ — and if it does, the code skips WordPress's standard REST API nonce validation entirely, on the assumption that the request is a harmless internal editor-telemetry call. The problem is that this string check runs against the raw URI, not the resolved route, and the URI can also carry attacker-controlled query parameters.

One Link, No JavaScript Required

That gap let an attacker craft a single URL that satisfied Elementor's "contains elementor/v1/events/" check while the WordPress REST router actually dispatched the request to a completely different endpoint — including the core /wp/v2/users route used to create new user accounts. Because the nonce check never ran, the forged request executed using whatever session cookies the victim's browser already held. Patchstack summarized the impact bluntly: "One link, opened by a logged-in WordPress user, makes that user carry out any REST API action their account is permitted to perform." Critically, the proof-of-concept required no JavaScript, no attacker-controlled webpage, and no form submission — just a single click on a malicious link, deliverable by email, chat message, or even a WordPress comment. If the victim who clicks the link is a site administrator, the forged request creates a new account with the administrator role, fully controlled by the attacker.

Not Just Elementor's Own Endpoints

Patchstack emphasized that this was not a narrow bug confined to Elementor's own REST routes. Because the nonce bypass is evaluated before WordPress finishes routing the request, it applies to the entire REST API surface of an affected site — core WordPress endpoints and the routes exposed by every other installed plugin. Researchers demonstrated the breadth of the issue beyond account creation, too: a GET request to /wp-json/wp/v2/settings, normally blocked with an HTTP 401 for unauthenticated context, returned HTTP 200 with the site's settings in the response body once the bypass string was appended. Elementor's fix in 4.3.2 closes the hole by validating the actual resolved REST route the request maps to, rather than pattern-matching against the raw request URI.

Impact Assessment

Recommendations

For WordPress Site Owners and Administrators

• Update Elementor to version 4.3.2 or later immediately. Sites on 4.3.0 or 4.3.1 should treat this as an emergency patch, not routine maintenance.
• Audit the Users list for any unexpected accounts with the administrator role created since September 22, 2026, and remove or lock down anything unfamiliar.
• Rotate credentials for existing administrator accounts if any suspicious activity, plugin changes, or new users are found from the exposure window.
• Review REST API access logs for requests where the query string or path contains elementor/v1/events paired with an unrelated endpoint such as /wp/v2/users or /wp/v2/settings.

For Security Teams and MSSPs

• Treat this as an active indicator-of-compromise hunt across managed WordPress fleets — search WAF and access logs for the elementor/v1/events/ marker appended to REST paths it has no legitimate reason to accompany.
• Prioritize pushing Elementor 4.3.2 to every managed site running the plugin rather than waiting for a standard patch window, given the low attack complexity (a single link) and high impact (full site takeover).
• Consider a temporary WAF rule blocking REST requests where the resolved route is unrelated to Elementor but the URI contains the bypass string, as a stopgap on sites that cannot patch immediately.

For Plugin and Theme Developers

• Never validate a REST request's legitimacy by string-matching the raw request URI. Validate against the resolved route or handler that WordPress actually dispatches to.
• Any code path that intentionally skips a core nonce or capability check for a specific internal integration should scope that exception as narrowly as possible — an exact route match, not a substring match against attacker-influenced input.

Key Takeaways

1. CVE-2026-62062 (CVSS 8.8) is a CSRF flaw in Elementor 4.3.0 and 4.3.1 that let an attacker create a rogue WordPress administrator account with a single clicked link.
2. The root cause was Elementor's Editor Events module bypassing REST API nonce validation whenever the raw request URI contained elementor/v1/events/, regardless of which endpoint was actually being called.
3. Because the bypass ran before routing, it exposed the site's entire REST API surface — WordPress core routes and every other installed plugin's routes — not just Elementor's own functionality.
4. Exploitation required no JavaScript, crafted webpage, or form submission — just a malicious link delivered via email, chat, or even a site comment.
5. Up to 2 million of Elementor's roughly 10 million installations were running a vulnerable version before Elementor shipped the fix in 4.3.2 on September 24, 2026, two days after Patchstack's report.
6. Site owners should update immediately and audit their Users list for unauthorized administrator accounts created during the exposure window.

Sources

• BleepingComputer — Elementor WordPress flaw lets attackers create admin accounts
• Patchstack — Cross-Site Request Forgery in Elementor Plugin Affecting 2 Million+ Sites