A URL substring match lets Elementor's Editor Events skip WordPress's REST nonce

The flaw is in how the Editor Events auth filter decides whether a request belongs to it. According to Patchstack, the filter checks the request URI for the event route as a partial match rather than the resolved REST route ^[7]. An attacker builds one URL that carries the legitimate-looking string `elementor/v1/events/` somewhere inside it, appends `_method=POST` to make a browser GET behave like a write, and hangs a user-creation payload off the end ^[6]. Elementor sees its own route inside REQUEST_URI, returns true, and WordPress skips the REST nonce it would otherwise demand ^[7].

That nonce is the whole cross-site request forgery defense on this route. It is the token that proves a write came from the site's own editor and not from a link on someone else's page. Skip the check, and any request riding the administrator's session cookie is treated as authorized. So the WordPress REST API processes the user-creation route with the victim's administrator privileges and creates the account the attacker specified ^[8]. The admin who clicked may see nothing more than a JSON blob of user data come back ^[16].

Two conditions have to hold. Elementor must be 4.3.0 or 4.3.1 with the experimental Editor Events feature enabled, and the target has to open the crafted link while logged in ^[10]. The documented fix is to update to 4.3.2 or later ^[9]. Because the attack needs the feature switched on, turning Editor Events off removes the precondition on a site that cannot patch immediately ^[11].

The scoring is where the two writeups part. Patchstack rates the flaw CVSS 8.8; the dev.to advisory relaying the research marks it critical, on the grounds that the payoff is full administrative privileges ^[3]. Elementor is installed on more than two million sites, though only those running the experimental feature are reachable ^[4].

For detection, Patchstack points at the request itself: review web server, reverse proxy, or WAF logs for GET requests that contain `elementor/v1/events/` together with `_method=POST`, plus hits on the user-creation route ^[12]. Watching for new administrator accounts is worth doing, but it catches the aftermath. Alerting on a created account, or disabling it later, does not stop the forged request from succeeding ^[13].

The disclosure is dated September 25, 2026, and BleepingComputer reported the same flaw ^[15]. Patchstack's proof of concept confirmed both halves of the chain in a research environment: an administrator opening the link, and a new administrator account appearing. No exploitation has been reported in the wild ^[14].