Elementor WordPress Plugin Flaw Allows Unauthorised Admin Account Creation

A cross-site request forgery (CSRF) vulnerability in the Elementor WordPress plugin could allow unauthenticated attackers to create unauthorised administrator accounts. The flaw puts an estimated 2 million websites at risk.

The vulnerability impacts versions 4.3.0 and 4.3.1 of the Elementor Website Builder. Elementor is a widely used drag-and-drop interface for WordPress, active on approximately 10 million websites globally.

Technical Breakdown of the Flaw

Security firm Patchstack identified the issue, noting that it originates within Elementor’s Editor Events module. The module checks the raw request URI for the elementor/v1/events/ path and, when present, bypasses the standard WordPress REST API nonce validation.

Because the URI can include attacker-controlled query parameters, a threat actor can append this specific path to requests targeting other REST endpoints. This allows them to trick a logged-in user into executing actions using that user’s existing privileges.

One-Click Attack Vector

The flaw can be exploited through a “one-click” attack. An attacker only needs to convince a logged-in administrator to open a malicious link. This link can be delivered via email, a chat message, or as a comment on the website itself.

Once the link is opened, the victim’s authenticated session performs the requested REST API action, which, on default installations, results in the creation of a new administrator account under the attacker’s control. The attack does not require JavaScript or a specifically controlled webpage to succeed.

Mitigation and Patching

The vulnerability was reported to the Elementor team on 22 September 2026 by bug hunter Saggre. Elementor has since released a fix in version 4.3.2, which prevents attackers from triggering the bypass through the query string.

Website administrators using Elementor are strongly advised to upgrade to version 4.3.2 or later immediately to secure their installations.