Critical Elementor CSRF flaw lets attackers create admin accounts on 2M+ WordPress sites

What happened

Patchstack has disclosed a critical cross-site request forgery (CSRF) vulnerability in Elementor, the WordPress page builder active on more than 2 million sites. The flaw affects Elementor 4.3.0 and 4.3.1 and allows an attacker to create an administrator account on a vulnerable site simply by getting a logged-in administrator to open a single crafted link. Patchstack scores the issue at CVSS 8.8 and treats it as critical because of the impact on administrative privileges. In its disclosure, published September 25, 2026, the company said no active exploitation had been observed in the wild. BleepingComputer separately reported the flaw.

How the one-click attack works

According to Patchstack, the problem lies in how Elementor validated its own REST routes. The plugin registered a callback on WordPress's rest_authentication_errors filter at priority 0 and returned true, effectively authenticating the request, whenever the request URI contained the string elementor/v1/events/ anywhere. Because that check is a partial match rather than an exact route comparison, the string can be planted in an arbitrary URL.

An attacker constructs a link that combines a fake Elementor path, a _method=POST parameter, and a user-creation payload aimed at WordPress's real /wp-/wp/v2/users endpoint. When an administrator opens that link in a browser where they are already logged in, Elementor's filter mistakes the doctored URI for a legitimate event route and returns true, bypassing WordPress's REST nonce validation. The REST API then processes user creation using the victim's cookie authentication and administrator privileges, and an attacker-controlled administrator account appears on the site.

Patchstack's proof of concept required no JavaScript or embedded form on an attacker-controlled page; opening the link is enough, and the victim may see a JSON response containing user information. The bypass does not open every REST route, and its effects are limited to what the victim's own permissions allow. Pointed at an administrator, however, that limit is exactly what makes the attack succeed.

Why so many sites are exposed

The vulnerable code belongs to Elementor's Editor Events experimental feature, and two details widen its reach. The feature is enabled by default on sites whose first Elementor installation was version 3.32.0 or later, and it is hidden: it does not appear on the plugin's Experiments screen, so administrators cannot easily check whether it is active. Any site running 4.3.0 or 4.3.1 should assume it is affected.

Patching and detection

Elementor fixed the issue in version 4.3.2, which verifies that requests begin with permitted routes instead of matching a substring anywhere in the URI. Updating to 4.3.2 or later is the primary mitigation, and Patchstack notes that alerting on account creation helps detection but does not prevent the CSRF itself.

Sites that may have been exposed should review web server, reverse proxy and WAF logs for GET requests containing elementor/v1/events/ together with _method=POST, as well as requests to user-creation routes. Patchstack also recommends checking for newly created administrators, unexpected sessions and password changes, and cautions that missing logs do not prove a request never happened. If an unauthorized account is found, the advised follow-up is to remove it, revoke sessions for compromised accounts and rotate exposed credentials.

Why it matters

A rogue administrator account is close to full site compromise: an attacker can install plugins and themes, edit any content and plant persistent malicious code, turning a widely deployed page builder into a malware or defacement channel. With more than 2 million installs, a default-on and hidden feature doing the damage, and an exploit that needs only one click from a logged-in administrator, the risk of mass exploitation after public disclosure is significant. The bug is also a reminder that authentication shortcuts inside plugin-specific REST handling can quietly defeat WordPress's own nonce protections. Site owners should update Elementor to 4.3.2 or later immediately and audit their user lists for administrators they did not create.