Elementor Plugin CSRF Flaw Lets Attackers Create Admin Accounts on WordPress Sites

A cross-site request forgery (CSRF) vulnerability in the Elementor plugin for WordPress has been reported by BleepingComputer. According to the report, the flaw could allow an unauthenticated attacker to trick a logged-in privileged user into performing an action that results in the creation of a new administrator account.

Why It Matters

Elementor is one of the most widely deployed WordPress page-builder plugins, running on a large share of WordPress sites. A CSRF-driven account-creation bug is significant because it does not require the attacker to steal credentials or find an authentication bypass — it only requires getting an authenticated administrator to visit a malicious page or click a crafted link while logged into their WordPress dashboard. Successful exploitation would hand the attacker a full administrator account, effectively granting complete control of the affected site (arbitrary plugin/theme installation, content manipulation, and potential server-level compromise depending on hosting configuration).

What Defenders Should Watch For

• Confirm the Elementor version in use and prioritize applying the vendor's patched release as soon as it is available or confirmed.
• Review the WordPress admin users list for unexpected or newly created administrator accounts, especially ones not tied to a known onboarding event.
• Audit `wp_users`/`wp_usermeta` creation timestamps and check web server / WAF logs for POST requests to admin-ajax.php or REST API endpoints associated with Elementor around unexplained account creation.
• As a general CSRF mitigation, ensure WordPress admins avoid browsing untrusted sites or clicking unknown links while authenticated to wp-admin, and consider enforcing nonce/referer checks and re-authentication for sensitive account-management actions where possible.
• Restrict wp-admin access by IP allowlist or additional authentication (e.g., a login-gate plugin or reverse-proxy auth) where feasible, as a defense-in-depth measure against CSRF-style admin-panel attacks.

Developing Story

This item is based on early reporting and details such as affected version ranges, patch availability, and in-the-wild exploitation status may evolve. This is not tied to a specific CVE detection at this time; check back for updates as more technical detail emerges. Read the original report from BleepingComputer: Elementor WordPress flaw lets attackers create admin accounts.