Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link
- Posted on September 26, 2026
- By The Hacker News
- 1 Views
- 1 min read
In brief
Elementor versions 4.3.0 and 4.3.1 are vulnerable to a critical Cross-Site Request Forgery attack that exploits administrator sessions. When an authenticated admin user clicks on a maliciously crafted link, attackers can seamlessly create unauthorized administrative accounts, gaining full control over WordPress sites. This vulnerability represents a significant security risk for website owners relying on Elementor's page builder functionality and requires immediate patching.
Summary auto-generated by AI from the original publisher's content. Editorial standards.
Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link
Elementor 4.3.0 and 4.3.1 contain a CSRF flaw that can create an admin account when a logged-in administrator opens a crafted link.
