Security3 publishers2 min readPublished
One clicked link creates an attacker admin on Elementor 4.3.0 and 4.3.1
Elementor 4.3.0 and 4.3.1 carry a CSRF flaw that lets an attacker turn one link, clicked by a logged-in admin, into a rogue administrator account. Version 4.3.2, released this week, closes the query-string bypass.
The Watch · Security desk
What happened
- Patchstack detailed a cross-site request forgery flaw in Elementor Website Builder that affects only plugin versions 4.3.0 and 4.3.1 and lets an unauthenticated attacker create a rogue administrator.
- The flaw has no CVE identifier yet and carries a CVSS score of 8.8 out of 10.0.
- Because the query string is attacker-written, the opt-out covers the whole REST API, including WordPress core and every other installed plugin, so a crafted link can hit /wp/v2/users to add an admin.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure More than 2 million sites run the two affected builds, and because the trigger can be a comment posted on the site, an operator does not have to go looking for the bait.
- capability Admin creation is one option among many: any REST action the victim's role permits is now attacker-triggerable through the same click.
- decision Auto-update settles this only if it has already moved a site to 4.3.2; anyone who pinned a version or disabled updates has to confirm the installed build.
- constraint Rolling back below 4.3.0 avoids this specific flaw but not the others, some of which are already under active exploitation.
The bug is in Elementor's Editor Events module. Patchstack found the module skips WordPress's CSRF nonce check on any cookie-authenticated REST request whose URI contains the literal string elementor/v1/events/ [14]. The request URI includes the query string, and the query string is written by whoever composes the link [15]. Any REST request can opt itself out of nonce validation by appending a parameter that carries that string.
The proof is a single link. Point a logged-in admin at /wp-json/wp/v2/users with the method set to POST, a username, an email, a password, and roles set to administrator, then append &x=elementor/v1/events/ to disarm the check [17]. The victim's browser sends its session cookie, and WordPress creates the account as if the admin asked for it.
The exemption is not scoped to Elementor. It covers the whole REST API surface, including WordPress core routes and the routes of every other plugin on the site [16].
"One link, opened by a logged-in WordPress user, makes that user carry out any REST API action their account is permitted to perform," Patchstack said [7]. On a default install, the account the attacker ends up with is a second administrator [8]. The attack does not need JavaScript, a submitted form, or a page the attacker controls; the link can travel in an email, a chat message, or a comment on the site [9][10].
Patchstack received the report from a researcher using the alias Saggre and disclosed it to Elementor on September 22; Elementor shipped 4.3.2 two days later, on September 24 [12][20][13]. The plugin runs on more than 10 million sites, and WordPress.org data puts the two affected versions at more than 2 million installs [4][5]. BleepingComputer and SC Media describe the affected population as up to 2 million [6].
Releases before 4.3.0 do not ship the Editor Events proxy and are not vulnerable to this flaw [18]. BleepingComputer notes some older Elementor versions carry other flaws already under active exploitation [19].
What to watch
- Whether a CVE identifier is assigned now that the request pattern is public.
- Any sign of active exploitation against 4.3.0 and 4.3.1 following disclosure.
- How fast Elementor's update channel moves sites off the two affected versions.