Elementor WordPress Flaw Could Let Attackers Create Admin Accounts
Summary
A CSRF flaw in Elementor 4.3.0 and 4.3.1 could let attackers trick logged-in administrators into creating attacker-controlled admin accounts. Elementor fixed the REST API bypass in version 4.3.2.
Key points
- The vulnerability affects Elementor for WordPress versions 4.3.0 and 4.3.1; the article says it had not yet received an identifier.
- An attacker can trick a logged-in administrator into opening a crafted link, causing the administrator’s authenticated session to perform a REST API action.
- On default installations, the attack can create an administrator account controlled by the attacker.
- Patchstack attributed the report to bug hunter Saggre and said it reported the issue to Elementor on September 22.
- Patchstack traced the flaw to the Editor Events module bypassing WordPress REST nonce validation when a particular path appears in the raw request URI.
- Elementor released version 4.3.2 to fix the bypass; users are urged to upgrade.
Article Details
- Vulnerability Types
- Cross-site request forgery (CSRF)
- Affected Versions
- Elementor 4.3.0
- Elementor 4.3.1
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available
People
Vendors
Products
ElementorA CSRF vulnerability in the Elementor WordPress plugin can let an attacker trick a logged-in administrator into creating a new attacker-controlled admin account through a crafted link.WordPressA CSRF vulnerability in the Elementor WordPress plugin can let an attacker trick a logged-in administrator into creating a new attacker-controlled admin account through a crafted link.