Cybersecurity
Elementor bug lets attackers create admin accounts
A CSRF flaw in Elementor Website Builder let an unauthenticated attacker turn a logged-in administrator’s session into account creation, and Elementor patched affected releases in version 4.3.2.
- Patchstack reported the flaw to Elementor on 22 September after receiving it from the bug hunter Saggre.
- Elementor released version 4.3.2 two days later to address the issue.
- The flaw affected Elementor versions 4.3.0 and 4.3.1, which WordPress.org said were used by up to 2 million sites.
- Patchstack said the issue could let an attacker make a logged-in administrator carry out a REST action with their own privileges.
- Elementor said earlier releases before 4.3.0 did not include the affected Editor Events proxy, though some of those versions had other actively exploited flaws.
Patchstack reported a cross-site request forgery flaw in Elementor Website Builder to Elementor on 22 September after getting it from the bug hunter Saggre. Elementor then released version 4.3.2 two days later.
The issue affected versions 4.3.0 and 4.3.1. WordPress.org’s figures said those releases were installed on up to 2 million sites.
Patchstack said the problem was in the Editor Events module, which checked the raw request URI for a particular path and skipped WordPress’s REST nonce checks when that path was present.
Because the URI could also carry attacker-controlled query parameters, Patchstack said an attacker could append the path to other REST requests and get a logged-in user to run them with their existing privileges.
Patchstack said this could be used in a one-click attack against a logged-in administrator to create a new administrator account controlled by the attacker. It said the link could be delivered by email, chat message or a site comment, and that no JavaScript, attacker-controlled webpage or submitted form was needed.
Named in this story
People
- Saggre
- the bug hunter who first found the issue
Companies
- Elementor
- released the fix in version 4.3.2
- Patchstack
- reported and analysed the vulnerability
Organisations
- WordPress.org
- supplied installation statistics for the affected versions
Products and systems
- Elementor Website Builder
- the WordPress plugin that contained the CSRF flaw
- WordPress
- the platform whose logged-in administrators could be tricked into acting
- Editor Events module
- the plugin component Patchstack said handled the request path incorrectly
How the source tells it
A plain security advisory with a mild urgency note from the update advice and a threat-focused description of admin account takeover.
- urgency the piece urged users to upgrade to the fixed release as soon as possible
- threat framing it focused on account takeover and one-click abuse of a logged-in administrator