One link in Elementor 4.3 can make an admin create another admin

Patchstack’s research team showed that Elementor Website Builder 4.3.0 and 4.3.1 will skip WordPress’s REST CSRF check if the string elementor/v1/events/ appears anywhere in the request URI, including the query string. A logged-in administrator who clicks a single crafted link can create a second administrator account for the attacker. No JavaScript and no attacker-controlled page are required.

Elementor is active on more than ten million sites. Only two releases are affected, but that is a lot of sites. Check that you are on 4.3.2 or newer.

If your page builder can turn a GET into a new admin, treat the plugin update like a password reset.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

A URL substring that switches off the CSRF check

Researcher Saggre reported the bug to Patchstack on Sep 22, 2026. Elementor shipped 4.3.2 on Sep 24. Patchstack published the advisory on Sep 25.

The vulnerable Editor Events module registers a rest_authentication_errors filter at priority 0. It decides “this is my route” with an unanchored strpos() over the raw REQUEST_URI. Because that string includes the query string, any REST request can opt out of cookie nonce checks by appending a harmless-looking parameter. Returning true tells every later handler, including WordPress core’s CSRF check, that authentication already succeeded.

WordPress also accepts _method=POST on a GET, so the entire attack fits in one URL mailed or messaged to an admin. Patchstack confirmed /wp/v2/users returns HTTP 201 with an administrator role when the bypass string is present, and that reading /wp/v2/settings flips from 401 to 200. The bypass applies to the whole REST surface, not only Elementor’s own endpoints. Sites whose first Elementor install was 3.32.0 or later had the hidden experiment on by default.

One click from an admin is enough

The attacker needs one click from a logged-in admin. Help desks, freelancers and marketing admins click links all day. On 4.3.0 or 4.3.1, any of those clicks can become a REST write made with the admin’s session.

The bypass covers every REST route the victim can reach, including routes added by other plugins. Updating Elementor stops new abuse. It does not remove an admin account someone already created.

Update to 4.3.2, then audit administrators

• Update Elementor to 4.3.2 or later on every site, including staging copies editors still use.
• List administrators. Compare wp_users / Users screen against your known admin set. Remove anything created since Sep 22 that you cannot explain.
• Review application passwords and JWT plugins that might have been created through REST during the same window.
• Tighten who is an Administrator. Editor and Shop Manager roles do not need to create users.
• Keep Patchstack / Wordfence style virtual patches in place until the fleet is verified.

Details

• Affected: Elementor Website Builder 4.3.0 and 4.3.1 only
• Fixed: 4.3.2 (Sep 24, 2026)
• Issue: Unauthenticated CSRF to privilege escalation via REST nonce bypass (CVSS 8.8 per Patchstack)
• Trigger: substring elementor/v1/events/ in the request URI, including query string
• Impact: any REST action the victim’s role allows, including creating an administrator via /wp/v2/users
• Reporter: Saggre via Patchstack; public advisory Sep 25, 2026

Hunt / verify

• Inventory Elementor versions across the fleet; flag anything still on 4.3.0 or 4.3.1.
• Search web server and WAF logs for elementor/v1/events/ inside query strings on /wp-json/ paths, especially with _method=POST and /wp/v2/users.
• Diff the Users list against a known-good export from before Sep 22.
• Check for unexpected application passwords, new OAuth apps, and plugin installs after Sep 22.

WordPress/Elementor: confirm Elementor >= 4.3.2 (not 4.3.0/4.3.1), audit admin users created since Sep 22, hunt /wp-json/* requests whose query string contains elementor/v1/events/.

Sources

• Patchstack: Cross-Site Request Forgery in Elementor Plugin Affecting 2 Million+ Sites (Sep 25, 2026)
• Elementor plugin changelog (4.3.2)

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].