Elementor CSRF Flaw Can Turn One Administrator Click Into Full WordPress Control

A cross-site request forgery vulnerability in Elementor Website Builder allows an unauthenticated attacker to make a logged-in WordPress administrator perform privileged REST API actions. On default installations, the attacker can exploit the flaw to create a new administrator account under their control.

The issue affects Elementor versions 4.3.0 and 4.3.1. Elementor has addressed it in version 4.3.2, which site operators should install immediately.

Patchstack published details on September 25, 2026. It said Elementor was notified on September 22, after bug hunter “Saggre” submitted the vulnerability. The patched release arrived two days after that notification.

A route check disables a critical WordPress defense

The vulnerability originates in Elementor’s Editor Events module. That component inspects the raw request URI and looks for the path:

elementor/v1/events/

When the string is present, the module bypasses WordPress REST nonce validation. REST nonces help WordPress confirm that an authenticated request was intentionally initiated by the logged-in user rather than forced by an external party.

The weakness lies in how Elementor identifies the route. Instead of securely determining which REST endpoint is being called, the module searches the complete, attacker-influenced URI for the expected string.

Query parameters are part of that raw URI. An attacker can therefore send a request to a different REST API endpoint while adding elementor/v1/events/ inside the query string. Elementor sees the trusted-looking path and suppresses nonce verification, even though the actual request targets another endpoint.

The victim’s browser still includes the victim’s authenticated WordPress session. As a result, the REST request runs with the victim’s existing permissions.

This is not an authentication bypass in which an attacker directly logs in as an administrator. It is a CSRF attack that makes an already authenticated administrator’s browser act on the attacker’s behalf. The practical outcome can nevertheless be equivalent to account takeover.

One malicious link can create a persistent administrator

Exploitation requires a WordPress administrator to be logged in and then open an attacker-crafted URL. The link could arrive through email or chat, or be placed in a comment on the targeted website.

The attack has unusually few delivery requirements. It does not need:

• JavaScript execution;
• an attacker-controlled web page;
• a hidden or submitted HTML form;
• prior authentication to the target WordPress site.

A single click is sufficient if the administrator has an active session.

On a default WordPress installation, the forged REST request can create another administrator account. That gives the attacker persistent access independent of the victim’s session. Even if the original malicious link is never opened again, the newly created account remains available until defenders identify and remove it.

An attacker-controlled administrator account can expose site content, configuration and user data. It can also provide access to plugin and theme management capabilities, depending on the site’s configuration and any additional security controls. The specific post-compromise actions observed in real attacks are not known.

No public severity score or CVE identifier has been assigned to this vulnerability. Information about active exploitation in the wild has also not been disclosed. There is no stated CISA Known Exploited Vulnerabilities catalog entry or federal remediation deadline.

Up to two million sites may be running affected releases

Elementor Website Builder is active on approximately 10 million websites. WordPress.org adoption statistics indicate that as many as 2 million sites could be using versions affected by this flaw.

The version boundaries are narrow but significant:

Elementor version	Status
4.3.0	Vulnerable
4.3.1	Vulnerable
4.3.2	Fixed
Earlier than 4.3.0	Not affected by this specific Editor Events flaw

Versions older than 4.3.0 do not include the vulnerable Editor Events proxy. Staying on an earlier release is not a safe workaround, however. Those versions contain other security flaws, including vulnerabilities already under active exploitation.

The correct response is therefore to upgrade to 4.3.2, not to downgrade.

The scale of Elementor’s installation base increases the likelihood of opportunistic scanning and mass-delivered lures. Attackers do not necessarily need to know whether a particular administrator is currently logged in. They can distribute links broadly and wait for one to reach a user with an active privileged session.

Version 4.3.2 closes the query-string bypass

Elementor 4.3.2 prevents attackers from using the query string to make an unrelated REST request appear to target the Editor Events route. Administrators should verify the installed version rather than relying solely on an assumed automatic-update policy.

The immediate remediation steps are:

1. Upgrade Elementor Website Builder to version 4.3.2.
2. Confirm that versions 4.3.0 and 4.3.1 are no longer active anywhere, including staging or secondary WordPress installations.
3. Review administrator accounts for users that were not deliberately created.
4. Examine recent account-management activity and REST requests, where suitable logs are available.
5. Terminate active administrator sessions and reset credentials if unauthorized privileged activity is found.

The only concrete request artifact described for this vulnerability is the string:

elementor/v1/events/

Defenders can search web-server, reverse-proxy, web application firewall and application logs for that path appearing unexpectedly in query strings or in requests to unrelated REST endpoints. Its presence alone is not proof of compromise, because legitimate Elementor traffic may use the same route. Context matters: the actual endpoint, query placement, response status and associated account activity should be examined together.

Sites should also check for recently added administrator users, especially accounts with unfamiliar names, email addresses or creation times. The available information does not identify specific malicious usernames, IP addresses or other campaign-level indicators.

The broader risk is administrator-assisted compromise

This vulnerability belongs to a class of attacks that uses a trusted administrator’s browser as the execution mechanism. The attacker does not defeat the administrator’s password or directly steal a session cookie. Instead, weak request validation allows a crafted link to convert the administrator’s existing session into a privileged action.

That model makes normal phishing defenses relevant, but user caution is not a substitute for patching. Links can be disguised, shortened or embedded in places where administrators routinely click. The lack of JavaScript or a dedicated malicious site also reduces the infrastructure an attacker must operate.

WordPress has recently faced another administrator-interaction flaw in which a visit could be abused to force a theme installation, potentially enabling a larger compromise chain. That issue was described as Click2Shell, an attack turning an administrator visit into a forced theme installation.

For Elementor users, the remediation is direct: install 4.3.2. The flaw may not yet have a CVE or severity score, but its default impact—creation of an attacker-controlled administrator—provides enough reason to treat the update as urgent.