One Click, One Admin Account, One Compromised Site
A high-severity cross-site request forgery (CSRF) vulnerability in the Elementor Website Builder WordPress plugin let an unauthenticated attacker create a rogue administrator account on a victim's site — no JavaScript, no attacker-hosted page, and no form submission required. The flaw, now tracked as CVE-2026-62062 with a CVSS score of 8.8, affected Elementor versions 4.3.0 and 4.3.1, which together account for more than 2 million active installations according to WordPress.org install statistics. Elementor itself runs on over 10 million WordPress sites, making it one of the most widely deployed page builders in the ecosystem.
What set this bug apart from typical CSRF attacks is how little the attacker needed to pull it off. Classic CSRF exploitation usually requires hosting a malicious page with auto-submitting JavaScript or a hidden form. Here, the entire payload was a plain-text hyperlink — something that could be dropped into a support ticket reply, an invoice email, a blog comment, or a chat message, and still work the moment a logged-in administrator clicked it.
Details
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-62062 |
| CVSS Score | 8.8 (High) |
| Component | Elementor Website Builder — Editor Events module |
| Vulnerability Type | Cross-Site Request Forgery (CSRF) leading to privilege escalation |
| Affected Versions | 4.3.0, 4.3.1 |
| Fixed Version | 4.3.2 |
| Installations Affected | 2,000,000+ (versions 4.3.0-4.3.1 combined) |
| Total Plugin User Base | 10,000,000+ active installs |
| Discovered By | Security researcher "Saggre" |
| Coordinated By | Patchstack |
| Reported to Vendor | September 22, 2026 |
| Patch Released | Elementor 4.3.2 |
| Exploitation Status | Not listed on CISA KEV catalog as of publication |
How the Exploit Chain Worked
A Hidden Feature Turns Off CSRF Protection
According to Patchstack's analysis, the root cause sat inside Elementor's Editor Events module — a REST API proxy that Elementor added as an on-by-default feature. The module was designed to relay editor telemetry events, but it contained a shortcut: whenever the string elementor/v1/events/ appeared anywhere in a request's query string, WordPress's REST nonce validation was skipped for that request — not just for the events endpoint, but effectively for the whole REST API surface the bug touched.
That meant an attacker could construct a URL pointing at a sensitive WordPress REST endpoint — such as the one used to create users — while smuggling the magic elementor/v1/events/ string into the query parameters. WordPress's nonce check, normally the only real defense against CSRF on REST requests, never fired.
From a Clicked Link to a New Admin
The attack required only that a logged-in WordPress administrator open the crafted link in their browser. Because the victim's browser automatically attached their authenticated session cookies to the request, the forged call executed with the admin's own permissions. On a default WordPress installation, that was enough to silently create a brand-new administrator account under the attacker's control — no password reset flow, no email confirmation step, and no visible warning to the victim beyond the page they landed on.
Patchstack summarized the risk plainly: "One link, opened by a logged-in WordPress user, makes that user carry out any REST API action their account is permitted to perform." Because the exploit needed no JavaScript, no attacker-controlled hosting, and no form auto-submission, it was far easier to disguise as an ordinary link than a traditional CSRF payload — raising the odds a busy site admin would click it without a second thought.
Who Was Exposed
Only sites running Elementor 4.3.0 or 4.3.1 were vulnerable — the Editor Events proxy did not exist in earlier releases, so any site on a version prior to 4.3.0 was never affected by this specific bypass. Because the two vulnerable releases were recent, roughly 2 million active installs were sitting in the exposure window before the fix shipped.
Impact Assessment
| Impact Area | Description |
|---|---|
| Site Takeover | Attacker-controlled admin account grants full control: themes, plugins, users, and content |
| Persistence | A rogue admin account can install a webshell or backdoor plugin for long-term access |
| Supply Chain Risk | Compromised sites can be weaponized to serve malware, redirect traffic, or host phishing pages |
| Low Attack Complexity | Exploitation needs only one clicked link — no phishing infrastructure, no JavaScript |
| Detection Difficulty | The payload is indistinguishable from a normal URL; no obvious red flags for the victim |
| Scale | Over 2 million sites ran an affected version before the patch was released |
Patch Status and Mitigation
For Site Administrators
- Update immediately to Elementor 4.3.2 or later, which closes the query-string bypass and restores proper nonce validation on the Editor Events proxy.
- Audit the WordPress user list (
Users → All Users) for any administrator accounts you don't recognize, especially ones created recently with unfamiliar usernames or email domains. - If an unauthorized admin account is found, remove it immediately, rotate all admin passwords and API keys, and review recent plugin/theme installs and file changes for signs of a backdoor.
- Consider a WAF or virtual-patching rule (Patchstack and Wordfence both offer plugin-vulnerability shielding) as a stopgap on sites that cannot update immediately.
For Security Teams
- Treat any WordPress site running Elementor 4.3.0 or 4.3.1 as high priority for patching, even absent confirmed in-the-wild exploitation — the low complexity of this exploit chain makes it an attractive, easy win for opportunistic attackers once technical details circulate.
- Monitor for the string
elementor/v1/events/in web server access logs on unpatched sites as a possible exploitation indicator. - Flag CVE-2026-62062 in vulnerability management tooling and confirm patch status across any fleet of managed WordPress installations.
For Everyone Who Manages a WordPress Login
- Be cautious clicking unsolicited links — even plain-text ones — while logged into an administrative account, particularly from support tickets, comments, or unfamiliar email senders.
- Log out of the WordPress admin dashboard when not actively using it, and consider using a separate browser profile for administrative sessions to limit ambient authenticated exposure.
Key Takeaways
- CVE-2026-62062 (CVSS 8.8) let a single crafted link bypass WordPress's REST nonce validation via Elementor's Editor Events module.
- Only Elementor 4.3.0 and 4.3.1 were affected — over 2 million active installs were exposed before the fix.
- The exploit required no JavaScript, no attacker-hosted infrastructure, and no form submission — just a plain hyperlink clicked by a logged-in admin.
- Successful exploitation resulted in silent creation of a rogue administrator account, granting full site control.
- Elementor shipped a fix in version 4.3.2; site owners on 4.3.0 or 4.3.1 should update immediately.
- As of publication, the flaw was not listed on CISA's Known Exploited Vulnerabilities catalog, but its low exploitation complexity makes rapid patching essential.