A flaw in the Elementor Website Builder plugin for WordPress can let attackers create a new administrator account on a site if they trick a logged-in admin into opening a malicious link. The cross-site request forgery issue, which has no CVE yet, affects Elementor versions 4.3.0 and 4.3.1 and stems from a REST API nonce-validation bypass in the Editor Events module; Elementor fixed it in version 4.3.2. Patchstack says up to 2 million sites may be using the affected versions.
Why it matters: This can hand full site control to an attacker with a single click by an already logged-in administrator, so affected site owners should update to Elementor 4.3.2 immediately. Admins should also be cautious with links sent by email, chat, or site comments until patching is complete.
info@thehackernews.com (The Hacker News)
2026.09.26
95% relevant
This appears to be the same underlying Elementor security issue, adding reporting that the flaw is a cross-site request forgery attack requiring an administrator to click a crafted link and that successful exploitation can lead to full site takeover.
Bill Toulas
2026.09.25
100% relevant
This article establishes a new tracked story around a newly disclosed and quickly patched Elementor vulnerability affecting versions 4.3.0 and 4.3.1.
← Back to all stories