Elementor WordPress CSRF Flaw Allows Admin Account Creation
A CSRF flaw in Elementor Website Builder versions 4.3.0 and 4.3.1 can let an attacker induce a logged-in WordPress administrator to create an attacker-controlled admin account. Version 4.3.2 fixes the issue.
Why it matters
A forged request using an administrator's authenticated browser session can lead to account creation and site takeover on affected installations.
SOC impact
Identify affected Elementor installations, update them, and review WordPress user creation and administrator activity for unexpected accounts. Correlate suspicious REST API requests with administrator sessions where relevant logs are available.
Recommended actions
- Identify WordPress instances running Elementor Website Builder 4.3.0 or 4.3.1
- Update affected installations to Elementor 4.3.2 or later
- Review recently created administrator accounts and remove any unauthorized users after investigation
- Correlate suspicious REST API requests with authenticated administrator sessions
- Review BleepingComputer's coverage and Patchstack's advisory for technical details
Executive Summary
A cross-site request forgery vulnerability in Elementor Website Builder versions 4.3.0 and 4.3.1 can bypass nonce validation for certain WordPress REST API requests. An attacker without a WordPress account can trick a logged-in administrator into opening a crafted link, causing that administrator’s browser to perform an authorized action. On a default installation, the demonstrated outcome is creation of a new administrator account controlled by the attacker. Elementor 4.3.2 addresses the flaw. Security teams should identify affected sites, update the plugin, and check for unauthorized administrator accounts.
SOC Impact
Identify affected Elementor installations, update them, and review WordPress user creation and administrator activity for unexpected accounts. Correlate suspicious REST API requests with administrator sessions where relevant logs are available.
Authentication and Access Validation
- Identify WordPress instances running Elementor Website Builder 4.3.0 or 4.3.1
- Update affected installations to Elementor 4.3.2 or later
- Review recently created administrator accounts and remove any unauthorized users after investigation
- Correlate suspicious REST API requests with authenticated administrator sessions
- Review BleepingComputer’s coverage and Patchstack’s advisory for technical details
Why It Matters
A forged request using an administrator’s authenticated browser session can lead to account creation and site takeover on affected installations.