A CSRF vulnerability in the Elementor page builder plugin affects more than 2 million WordPress sites, allowing attackers to create administrator accounts on vulnerable installations.
The flaw impacts versions 4.3.0 and 4.3.1, which together account for over 2 million active installations. Elementor itself is present in more than 10 million WordPress sites. The vulnerability received a CVSS score of 8.8, placing it in the high severity range. At the time of public disclosure on September 26, no CVE identifier had been assigned.
The root cause lies in the Editor Events module, which fails to properly enforce CSRF protections on cookie-authenticated requests to the WordPress REST API. By appending the parameter elementor/v1/events/ as a query string, any REST request bypasses the plugin's verification checks. This occurs because the browser automatically includes session cookies with every request, and the plugin does not confirm whether the request originated from the legitimate site dashboard.
The attack requires no special form, JavaScript, or attacker-controlled webpage. A simple link, such as an anchor in an email or instant message, is sufficient. When a logged-in administrator clicks the link, the browser sends an authenticated request that, on a default installation, results in the creation of a second administrator account.
Beyond the plugin itself, the flaw exposes the entire surface of the WordPress REST API, including core endpoints and routes provided by other plugins installed on the same site. The issue was discovered by researcher Saggre and resolved through responsible disclosure. The fix was released in version 4.3.2. Site owners running the affected versions should update immediately. At the time of analysis, no public evidence of active exploitation had been recorded.
