Elementor WordPress Plugin Flaw Allows Unauthorised Admin Account Creation

A cross-site request forgery (CSRF) vulnerability in the Elementor plugin for WordPress could allow unauthenticated attackers to create administrator accounts, potentially leading to full website takeover.

The flaw impacts versions 4.3.0 and 4.3.1 of the popular website builder. Security firm Patchstack reported the issue after it was discovered by researcher “Saggre”.

Elementor is a widely used drag-and-drop interface for WordPress, active on approximately 10 million websites. Statistics from WordPress.org suggest that the two vulnerable versions are in use by up to 2 million sites.

Technical Details of the CSRF Vulnerability

The vulnerability stems from Elementor’s Editor Events module. According to Patchstack’s analysis, the module checks the raw request URI for a specific path, elementor/v1/events/, and subsequently bypasses WordPress’s REST nonce validation when that string is detected.

Because the URI can contain attacker-controlled query parameters, a threat actor can append the target path to requests aimed at other REST endpoints. By tricking a logged-in administrator into opening a malicious link via email, chat, or a site comment, the attacker can force the victim’s authenticated session to perform administrative actions.

This “one-click” attack method does not require JavaScript, a specifically crafted webpage, or a submitted form. Once the link is clicked, the attacker can execute the REST API action required to create a new administrator account under their own control.

Remediation and Updates

Elementor has released a security patch in version 4.3.2, which prevents attackers from triggering the bypass through the query string.

Administrators using the Elementor plugin are urged to upgrade to version 4.3.2 as soon as possible to mitigate the risk of unauthorised access.