One clicked link creates an attacker admin on Elementor 4.3.0 and 4.3.1
Elementor 4.3.0 and 4.3.1 carry a CSRF flaw that lets an attacker turn one link, clicked by a logged-in admin, into a rogue administrator account. Version 4.3.2, released this week, closes the query-string bypass.
The Watch · Security desk
What happened
- Patchstack detailed a cross-site request forgery flaw in Elementor Website Builder that affects only plugin versions 4.3.0 and 4.3.1 and lets an unauthenticated attacker create a rogue administrator.
- The flaw has no CVE identifier yet and carries a CVSS score of 8.8 out of 10.0.
- Because the query string is attacker-written, the opt-out covers the whole REST API, including WordPress core and every other installed plugin, so a crafted link can hit /wp/v2/users to add an admin.
Why it matters
- Who's exposed exposure More than 2 million sites run the two affected builds, and because the trigger can be a comment posted on the site, an operator does not have to go looking for the bait.
- What's now possible capability Admin creation is one option among many: any REST action the victim's role permits is now attacker-triggerable through the same click.
- Who has to decide decision Auto-update settles this only if it has already moved a site to 4.3.2; anyone who pinned a version or disabled updates has to confirm the installed build.
- What it limits constraint Rolling back below 4.3.0 avoids this specific flaw but not the others, some of which are already under active exploitation.
Next story · Security · 4d ago
Bricksforge's unauthenticated upload flaw is being used to run PHP on WordPress sitesConfirmed3 publishers
The bug is in Elementor's Editor Events module. Patchstack found the module skips WordPress's CSRF nonce check on any cookie-authenticated REST request whose URI contains the literal string elementor/v1/events/ [13]. The request URI includes the query string, and the query string is written by whoever composes the link [15]. Any REST request can opt itself out of nonce validation by appending a parameter that carries that string.
The proof is a single link. Point a logged-in admin at /wp-json/wp/v2/users with the method set to POST, a username, an email, a password, and roles set to administrator, then append &x=elementor/v1/events/ to disarm the check [17]. The victim's browser sends its session cookie, and WordPress creates the account as if the admin asked for it.
The exemption is not scoped to Elementor. It covers the whole REST API surface, including WordPress core routes and the routes of every other plugin on the site [16].
"One link, opened by a logged-in WordPress user, makes that user carry out any REST API action their account is permitted to perform," Patchstack said [6]. On a default install, the account the attacker ends up with is a second administrator [7]. The attack does not need JavaScript, a submitted form, or a page the attacker controls; the link can travel in an email, a chat message, or a comment on the site [8][9].
Patchstack received the report from a researcher using the alias Saggre and disclosed it to Elementor on September 22; Elementor shipped 4.3.2 two days later, on September 24 [11][19][12]. The plugin runs on more than 10 million sites, and WordPress.org data puts the two affected versions at more than 2 million installs [3][4]. BleepingComputer and SC Media describe the affected population as up to 2 million [5].
Releases before 4.3.0 do not ship the Editor Events proxy and are not vulnerable to this flaw [18]. BleepingComputer notes some older Elementor versions carry other flaws already under active exploitation [20].
What to watch
- Whether a CVE identifier is assigned now that the request pattern is public.
- Any sign of active exploitation against 4.3.0 and 4.3.1 following disclosure.
- How fast Elementor's update channel moves sites off the two affected versions.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption60
- Hype gap+10
- Incentives30
- Confidence74
Perspective Coverage
3 publishers- Builder
- Builder 38%
- Operator
- Operator 55%
- Investor
- Investor 7%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
A high-severity flaw in the Elementor Website Builder WordPress plugin could be exploited by an unauthenticated attacker to create rogue administrator accounts and take control of a site.
- [2]
The flaw only affects versions 4.3.0 and 4.3.1 of the Elementor plugin.
- [3]
The Elementor plugin is active on over 10 million WordPress sites.
- [4]
WordPress.org statistics show the two impacted versions alone have been installed on more than 2 million sites.
- [5]
BleepingComputer and SC Media report that the two affected versions are used by up to 2 million sites.
- [6]
"One link, opened by a logged-in WordPress user, makes that user carry out any REST API action their account is permitted to perform," Patchstack said.
- [7]
Patchstack said that on a stock installation, an administrator clicking the link creates a second administrator account for the attacker.
- [8]
The attack does not hinge on any prerequisite such as JavaScript, a submitted form, or a web page under the attacker's control.
- [9]
The link can be a plain anchor tag embedded in an email, a chat message, or a comment.
- [10]
The issue has been addressed in version 4.3.2, released earlier this week.
- [11]
Patchstack reported the vulnerability to the Elementor team on September 22 after receiving it from bug hunter Saggre, and Elementor released a fix two days later in version 4.3.2.
- [12]
A security researcher going by the alias Saggre has been credited with discovering and reporting the bug.
- [13]
The vulnerability stems from the Editor Events module skipping CSRF protection for cookie-authenticated REST API requests every time the literal string elementor/v1/events/ appears anywhere in the request URI.
- [14]
The cross-site request forgery vulnerability has yet to be assigned a CVE identifier and carries a CVSS score of 8.8 out of 10.0.
- [15]
Because the request URI includes the query string, and the query string is written by whoever composes the link, any REST request can opt itself out of that protection by appending a harmless-looking parameter.
- [16]
The bypass applies to the entire REST API surface of a site, including WordPress core routes and the routes of every other plugin installed on it.
- [17]
An attacker could create an administrator account through /wp/v2/users using a request that sets the method to POST, supplies a username, email and password, sets roles to administrator, and appends x=elementor/v1/events/.
- [18]
Elementor releases before 4.3.0 do not ship the Editor Events proxy and are therefore not affected by this flaw.
- [19]
Elementor released the 4.3.2 fix on September 24.
- [20]
BleepingComputer notes that older Elementor versions are vulnerable to other flaws, some of which are already actively exploited.
Sources
2 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comElementor WordPress flaw lets attackers create admin accounts
1 article · September 25, 2026
- scworld.comElementor plugin vulnerability allows admin account creation
1 article · September 25, 2026
- thehackernews.comElementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link
2 articles · September 26, 2026
Topics and entities
Entities
- Patchstack
- CVSS
- WordPress
- Elementor Website Builder