Elementor Website Builder CSRF Flaw Enables Rogue Admin Account Creation

What Happened

A high-severity cross-site request forgery (CSRF) vulnerability has been disclosed in the Elementor Website Builder plugin for WordPress, according to reporting from The Hacker News. The flaw, which has not yet been assigned a CVE identifier, carries a CVSS score of 8.8 out of 10.0. Per the report, it only affects certain versions of the plugin, though the full affected version range was not detailed in the available summary.

The vulnerability reportedly allows an unauthenticated attacker to trick a logged-in administrator into clicking a crafted link, triggering a request that creates a rogue administrator account. That new account could then be used to take control of the site.

Why It Matters

Elementor is one of the most widely deployed WordPress page builder plugins, so any flaw affecting site takeover has a broad potential blast radius. A CSRF-based admin account creation bug is particularly dangerous because it does not require the attacker to have valid credentials or direct access to the target site — it only requires an authenticated admin to visit a malicious page or click a malicious link while logged into the WordPress dashboard.

What Defenders Should Watch For

• Confirm which Elementor version(s) are affected once a CVE and patched release are published, and prioritize patching WordPress sites running the plugin.
• Review recent WordPress admin/user account creation logs for unexpected new administrator accounts, especially any created outside of normal onboarding workflows.
• Hunt for anomalous wp-admin/user-new.php or equivalent user-management requests that lack the expected referrer or nonce validation context.
• Encourage administrators to avoid clicking unsolicited links while authenticated to the WordPress admin panel, and consider logging out of admin sessions when not actively managing the site.
• Where possible, deploy a Web Application Firewall (WAF) rule set that flags suspicious cross-origin POST requests to WordPress admin account-management endpoints.

Developing Story

This is based on early reporting and a CVE identifier has not yet been assigned, so specifics such as the exact affected version range and vendor remediation guidance may evolve. Defenders running Elementor should monitor for an official advisory and patch. For the original report, see The Hacker News.