Elementor WordPress Flaw Allows Attackers to Create Admin Accounts

A cross-site request forgery vulnerability in the Elementor plugin for WordPress could allow an unauthenticated attacker to create administrator accounts, according to reports from security firm Patchstack.

Vulnerability Details and Affected Versions

The security flaw impacts Elementor versions 4.3.0 and 4.3.1, which are installed on up to 2 million WordPress sites according to WordPress.org statistics. The Elementor Website Builder plugin as a whole is active on approximately 10 million websites. The vulnerability stems from Elementor’s Editor Events module, which inspects the raw request URI for a specific path and bypasses WordPress REST API nonce validation when that path is present. Because the URI includes attacker-controlled query parameters, attackers can append the path to requests targeting other REST endpoints.

Attack Vector and Discovery Timeline

Security firm Patchstack reported the vulnerability to the Elementor team on September 22, 2026, after receiving it from a bug hunter named “Saggre.” Elementor released a patched version, 4.3.2, two days later on September 24, 2026. The exploit enables one-click privilege escalation when an authenticated administrator opens a malicious link. According to Patchstack, the attack does not require JavaScript, a form submission, or an attacker-controlled webpage, meaning the link can be delivered via email, a chat message, or a comment on the site.

One link, opened by a logged-in WordPress user, makes that user carry out any REST API action their account is permitted to perform

Patchstack

Recommended Mitigation Steps

Administrators operating sites with the Elementor plugin are advised to upgrade to version 4.3.2 immediately. The update prevents attackers from exploiting the query-string technique to bypass security protections within the Editor Events module. Older versions of Elementor do not contain the affected Editor Events proxy, but those releases remain vulnerable to separate security issues.