Elementor WordPress Flaw Allows Unauthorised Admin Account Creation

A cross-site request forgery (CSRF) vulnerability in the Elementor plugin for WordPress could allow an unauthenticated attacker to create administrator accounts.

The flaw presents a significant security risk, as the creation of unauthorised administrator accounts can lead to total site compromise, data exfiltration, and the deployment of malicious content.

Technical Impact

The vulnerability leverages a CSRF flaw, which typically works by tricking a user with sufficient privileges, such as a site administrator, into performing an action without their knowledge. In this instance, an attacker could potentially trigger a request that results in the registration of a new account with full administrative permissions.

Once an attacker gains administrative access, they can modify website settings, access sensitive databases, install malicious plugins, or use the site to host phishing campaigns.

Mitigation and Security Steps

Website owners using the Elementor plugin should immediately ensure they are running the latest version of the software. Updating to the most recent release is the primary method for addressing this vulnerability.

To maintain a secure WordPress environment, administrators should also consider the following:

• Regularly monitor user accounts: Periodically review the list of registered users to detect any unauthorised or unexpected administrator accounts.
• Enable multi-factor authentication (MFA): Implementing MFA provides an essential additional layer of security for all administrative logins.
• Keep all components updated: Ensure that WordPress core, themes, and all other plugins are kept current with the latest security patches.