A critical cross-site request forgery (**CSRF**) vulnerability has been identified within the **Elementor Website Builder** plugin, a widely used tool for **WordPress** site creation. This flaw allows an unauthenticated attacker to exploit a logged-in administrator's session, potentially leading to the creation of a new, attacker-controlled administrator account on vulnerable sites. ### The Vulnerability Explained The **CSRF** vulnerability, which has yet to receive a **CVE** identifier, specifically impacts **Elementor** versions 4.3.0 and 4.3.1. Threat actors can leverage this by coercing a site administrator into opening a specially crafted malicious link. Once clicked, the victim's authenticated session unknowingly performs a REST API action, resulting in the creation of an administrator account under the attacker's control on default **WordPress** installations. ### Widespread Impact **Elementor Website Builder** is a cornerstone for many **WordPress** users, boasting an active installation base of 10 million websites. According to statistics from **WordPress.org**, the vulnerable versions 4.3.0 and 4.3.1 are currently in use on up to 2 million of these sites, highlighting the broad scope of potential exploitation. ### Swift Remediation Security firm **Patchstack** reported the vulnerability to the **Elementor** team on September 22, after receiving the initial discovery from bug hunter **Saggre**. Demonstrating a rapid response, **Elementor** released a fix just two days later, in version 4.3.2 of the plugin. ### Technical Details of the Flaw **Patchstack**'s analysis reveals that the **CSRF** flaw stems from **Elementor**'s Editor Events module. This module incorrectly checks the raw request URI for the `elementor/v1/events/` path, bypassing **WordPress**'s standard REST nonce validation when this string is present. Because the URI can also contain attacker-controlled query parameters, attackers can append this path to requests targeting other REST endpoints, effectively tricking logged-in users into executing them with their existing privileges. ### One-Click Attack Vector The simplicity of the attack is particularly concerning. **Patchstack** emphasizes that the flaw can be abused in one-click attacks against a logged-in administrator to create a new, attacker-controlled admin account. "One link, opened by a logged-in **WordPress** user, makes that user carry out any REST API action their account is permitted to perform," **Patchstack** explains. The firm further notes that this attack does not require JavaScript, an attacker-controlled webpage, or a submitted form, and the malicious link can be delivered via email, chat messages, or even site comments. ### Recommendations for Users While **Elementor** versions prior to 4.3.0 are not susceptible to this specific Editor Events proxy flaw, it's important to note that those older versions may harbor other vulnerabilities, some of which are already being actively exploited. Therefore, all users of the **Elementor** plugin are strongly advised to upgrade to version 4.3.2 or later as soon as possible. This updated version effectively prevents attackers from triggering the bypass through the query string, significantly enhancing site security.