Elementor CSRF Flaw Allows Site Takeover

Security researchers have identified a critical vulnerability in the Elementor Website Builder plugin for WordPress that allows unauthenticated attackers to seize control of affected websites. The flaw is a cross-site request forgery (CSRF) bug with a CVSS score of 8.8 out of 10.0. It impacts versions 4.3.0 and 4.3.1 of the plugin, which are currently installed on more than two million sites according to WordPress.org statistics. The issue was responsibly disclosed and patched in version 4.3.2 released earlier this week.

The vulnerability stems from how the Editor Events module handles security checks for REST API requests. Specifically, the module skips CSRF protection for cookie-authenticated requests whenever the literal string "elementor/v1/events/" appears anywhere in the request URI. Because the query string is part of the URI and can be controlled by whoever creates the link, an attacker can append this harmless-looking parameter to any REST API endpoint. This effectively opts the request out of CSRF protections across the entire site, including WordPress core routes and other plugins.

Patchstack, the security company that analyzed the flaw, explained that a single crafted link is sufficient to exploit this weakness. If a logged-in administrator clicks the link, their browser automatically executes the requested action using their credentials. On a standard WordPress installation, clicking such a link allows the attacker to create a new administrator account for themselves. This gives the attacker full control over the website without needing to know any passwords or bypass authentication screens.

The attack does not require JavaScript execution, a submitted form, or a web page hosted by the threat actor. The malicious link can be embedded in plain text, such as an email, a chat message, or a comment section. An example request shows how an attacker could create an admin user by targeting the /wp/v2/users endpoint while appending the bypass parameter. This demonstrates the severity of the bypass, as it affects the entire REST API surface of the vulnerable site.

Researchers noted that versions of Elementor prior to 4.3.0 are not affected because they do not include the Editor Events proxy that contains the flaw. However, users running versions 4.3.0 or 4.3.1 must update immediately to version 4.3.2 to secure their installations. The discovery was credited to a security researcher known as Saggre. For website owners relying on managed hosting services like AEU Hosting, ensuring your WordPress environment is updated to the latest stable version is a primary defense against such exploitation attempts.

This incident highlights the importance of keeping all plugins up to date. Even if a vulnerability requires user interaction, the ease of crafting the malicious link makes it a significant risk. Administrators should monitor their sites for unauthorized user accounts and review recent activity logs. Regular updates ensure that known flaws are addressed before they can be exploited in the wild. The quick release of version 4.3.2 demonstrates the vendor's responsiveness to responsible disclosure practices.