Site owners running Elementor should patch without delay. The WordPress page builder carries a high-severity flaw that turns a single link into a rogue administrator account, and Patchstack, which disclosed it, scores the cross-site request forgery bug at CVSS 8.8. No login is required and no CVE identifier has been assigned yet.
Only versions 4.3.0 and 4.3.1 carry the defect. Elementor is active on more than 10 million WordPress sites, and WordPress.org figures show those two releases alone sit on over two million installations. Earlier builds do not ship the vulnerable component and are unaffected.
A harmless-looking parameter disables the guard
The root cause sits in the plugin’s Editor Events module. It waives CSRF checks on cookie-authenticated REST API calls, but only when the text “elementor/v1/events/” turns up somewhere in the request URI. Whoever writes the link also writes the query string, so any REST request can append a harmless-looking parameter and slip past the guard.
That opens far more than one route. The exemption covers the whole REST surface, WordPress core routes and every other installed plugin included. On a standard setup the practical result is blunt: an administrator who opens the link finds a second admin account created for the attacker through the users endpoint. No script, form, or attacker-controlled page is involved, so a plain anchor tag in an email, chat message, or comment will do.
The fix landed in version 4.3.2, with researcher “Saggre” credited for the find.
