Reported by 9 outlets
Elementor WordPress flaw lets attackers create admin accounts
Why this score
- Breadth
- 2.00 / 2.0 · 9 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 3.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.03 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
CVE-2026-62062 is a CSRF vulnerability (CVSS 8.8) in the Elementor WordPress plugin's new Editor Events module, affecting only versions 4.3.0 and 4.3.1, released September 22 and 23, 2026, and patched in 4.3.2 on September 24. The window was short but the install base is huge: Elementor runs on more than 10 million sites, and roughly 2 million were on the vulnerable releases before the fix landed one to two days later.
The bug is a validation shortcut. The Editor Events module checked the raw REQUEST_URI for the literal string elementor/v1/events/ and skipped WordPress REST nonce validation whenever it matched, so any request containing that substring in the URI bypassed CSRF protection. The practical attack is one-click site takeover: a crafted link, once clicked by a logged-in administrator, creates a new administrator account under the attacker's control. Researcher Saggre reported it to Patchstack on September 22, and Elementor fixed 4.3.2 by reading the resolved REST route instead of the raw URI, which is the correct fix.
Anyone running Elementor should verify they are on 4.3.2 or later and check for unfamiliar administrator accounts, since the attack path leaves a persistent backdoor account behind. The story is a reminder that feature-release code ships with less scrutiny than security releases: the vulnerable module was two days old. Watch for exploitation reports tying rogue admin creation to this CSRF vector and for any follow-on campaigns automating the one-click takeover against Elementor sites.
Timeline
-
original reporting
Elementor WordPress flaw lets attackers create admin accounts https:// bleepingcomputer.com/news/security/ elementor-wordpress-flaw-lets-att
www.bleepingcomputer.com · 18d ago · September 25th, 2026
Elementor WordPress flaw lets attackers create admin accounts https:// bleepingcomputer.com/news/security/ elementor-wordpress-flaw-lets-att
via X https://www.bleepingcomputer.com/news/security/elementor-wordpress-flaw-lets-attackers-create-admin-accounts/
-
update from elementor.com
Elementor changelog: releases 4.3.0 (2026-09-22) and 4.3.1 (2026-09-23)
elementor.com · 22d ago · September 22nd, 2026
The Elementor changelog records the release of plugin versions 4.3.0 on 22 September 2026 (introducing the Editor Events module and other features) and 4.3.1 on 23 September 2026. The timeline from Patchstack confirms the security fix was delivered in version 4.3.2 on 24 September 2026, meaning the vulnerable releases existed for roughly one to two days before the patch.
-
update from patchstack.com
Patchstack vulnerability database entry and advisory timeline for Elementor CSRF (CVE-2026-62062)
patchstack.com · 19d ago · September 25th, 2026
Patchstack published the vulnerability entry on 25 September 2026, assigning CVE-2026-62062 (CVSS 8.8) to the Elementor Website Builder plugin CSRF affecting versions 4.3.0 and 4.3.1. The entry records researcher Saggre's original disclosure to Patchstack on 22 September 2026, the vendor fix in version 4.3.2 released on 24 September 2026, and the public advisory release on 25 September 2026.
-
update from patchstack.com
Patchstack security advisory article: Cross-Site Request Forgery in Elementor Plugin Affecting 2 Million+ Sites
patchstack.com · 19d ago · September 25th, 2026
Patchstack's public advisory, released 25 September 2026, details the CSRF mechanism in Elementor's Editor Events module: the raw REQUEST_URI check for the literal string elementor/v1/events/ bypasses WordPress REST nonce validation. The advisory confirms versions 4.3.0 and 4.3.1 are affected, that Patchstack received the report from researcher Saggre on 22 September, and that Elementor fixed it in 4.3.2 by reading the resolved REST route instead of the raw URI.
-
update from bleepingcomputer.com
BleepingComputer coverage of Elementor CSRF vulnerability
bleepingcomputer.com · 18d ago · September 25th, 2026
BleepingComputer published its report on 25 September 2026 at 02:13 PM (likely US time, making it potentially concurrent with or shortly before the story's 18:13 UTC first_seen). The article covers the same CSRF mechanism described by Patchstack, notes the 10 million active installations and up to 2 million sites running the vulnerable 4.3.0 and 4.3.1 versions, and confirms the fix in 4.3.2. It explicitly references Patchstack's analysis and links to the Patchstack advisory article.
-
update from bleepingcomputer.com
Elementor WordPress flaw lets attackers create admin accounts
bleepingcomputer.com · 18d ago · September 25th, 2026
A cross-site request forgery (CSRF) vulnerability in the Elementor plugin for WordPress could allow an unauthenticated attacker to create administrator accounts. Threat actors can exploit the flaw by tricking a logged-in administrator into opening a malicious link, causing the victim's authenticated session to perform a REST API action permitted by their account. On default installations, the result is the creation of an administrator account under the control of the attacker. The Elementor Website Builder is a popular WordPress plugin active on 10 million websites that lets users create websites using a drag-and-drop interface. The CSRF flaw has yet to receive an identifier and impacts only versions 4.3.0 and 4.3.1. According to statistics from WordPress.org, the two versions are used by up to 2 million sites . Security firm Patchstack reported the vulnerability to the Elementor team on September 22 after receiving it from bug hunter “Saggre.” Elementor released a fix two days later, in version 4.3.2 of the plugin. Because the URI also contains attacker-controlled query parameters, attackers can append the path to requests targeting other REST endpoints and trick logged-in users into executing them with their existing privileges.
-
update from dev.to
Elementor 4.3.0 and 4.3.1: CSRF Enables Administrator Account Creation via a Flawed REST Route Check # security # threatintel # software # c
dev.to · 18d ago · September 26th, 2026
Elementor 4.3.0 and 4.3.1: CSRF Enables Administrator Account Creation via a Flawed REST Route Check # security # threatintel # software # c
via Mastodon https://dev.to/anoymask/elementor-430-and-431-csrf-enables-administrator-account-creation-via-a-flawed-rest-route-check-4m57
-
mentioned by thehackernews.com
Elementor WordPress plugin (10M sites) CSRF flaw, CVSS 8.8: the Editor Events module skips REST nonce validation when URI contains element
thehackernews.com · 17d ago · September 26th, 2026
-
update from thehackernews.com
Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link Source: The Hacker News Read: https:// thehackernews.com/
thehackernews.com · 17d ago · September 26th, 2026
Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link Source: The Hacker News Read: https:// thehackernews.com/
via Mastodon https://thehackernews.com/2026/09/elementor-csrf-flaw-lets-attackers-take.html
-
mentioned by www.bleepingcomputer.com
# Elementor # WordPress flaw lets attackers create admin accounts https://www. bleepingcomputer.com/news/secu rity/elementor-wordpress-flaw-
www.bleepingcomputer.com · 17d ago · September 26th, 2026
-
mentioned by thecybersecguru.com
Elementor users should check their installations for CVE-2026-62062, a CVSS 8.8 CSRF vulnerability affecting Elementor 4.3.0 and 4.3.1. The
thecybersecguru.com · 17d ago · September 26th, 2026
-
mentioned by lemmy.world
Elementor CVE-2026-62062: CSRF vulnerability can enable WordPress admin account creation https:// lemmy.world/post/52400012
lemmy.world · 17d ago · September 26th, 2026
-
mentioned by thehackernews.com
🤖 Elementor (WordPress, active on 10M+ sites): CSRF flaw CVSS 8.8, no CVE ID yet. The Editor Events module skips CSRF checks whenever "eleme
thehackernews.com · 17d ago · September 26th, 2026
-
update from www.cyber-defence.io
Elementor 4.3.0/4.3.1 (~2 million sites) has a CSRF flaw where one crafted link — clicked by a logged-in admin — creates a new administrator
www.cyber-defence.io · 17d ago · September 27th, 2026
Elementor 4.3.0/4.3.1 (~2 million sites) has a CSRF flaw where one crafted link — clicked by a logged-in admin — creates a new administrator
via Mastodon https://www.cyber-defence.io/insights/elementor-csrf-flaw-one-click-site-takeover
-
update from www.bleepingcomputer.com
If you use the Elementor plugin on your website, update it immediately. A security flaw could allow unauthorized people to take control of y
www.bleepingcomputer.com · 15d ago · September 28th, 2026
If you use the Elementor plugin on your website, update it immediately.
-
update from meterpreter.org
Discover the critical CVE-2026-62062 Elementor CSRF vulnerability. Learn how this REST API bypass threatens millions of WordPress sites and
meterpreter.org · 15d ago · September 28th, 2026
Learn how this REST API bypass threatens millions of WordPress sites and
via Mastodon https://meterpreter.org/elementor-csrf-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social