Elementor flaw lets attackers create administrator accounts

Details emerged about a serious CSRF flaw in Elementor Website Builder. The issue affected versions 4.3.0 and 4.3.1, which WordPress.org statistics said were installed on more than 2 million sites, while the plugin was active on over 10 million WordPress sites.

Patchstack said a logged-in WordPress user who opened a crafted link could be made to perform REST API actions allowed by that account. On a stock installation, that could allow an attacker to create a new administrator account, and the link could be placed in email, chat messages or comments.

Patchstack said the problem was in the Editor Events module, which omitted CSRF checks for cookie-authenticated REST API requests when a particular string appeared in the request URI. It said the query string could be used to bypass the protection across the REST API, including WordPress core routes and routes from other plugins.

Elementor addressed the issue in version 4.3.2 after responsible disclosure. The researcher credited with finding it used the alias Saggre, and users were told to update as soon as possible.