"One link, opened by a logged-in WordPress user, makes that user carry out any REST API action their account is permitted to perform," Patchstack said.
How a single crafted link could hand over control
Researchers and a security vendor have detailed a cross-site request forgery (CSRF) flaw in the Elementor Website Builder plugin that allows an attacker to turn an ordinary click by a logged-in user into a full REST API action executed with that user's privileges. Patchstack described the effect bluntly: on a stock installation, an administrator clicking the crafted link creates a second administrator account for the attacker. The vulnerability requires no JavaScript, form submission, or control of a web page — the link can be a plain anchor tag embedded in an email, chat message, or comment.
Scope: versions, install base, and severity
The bug affects Elementor versions 4.3.0 and 4.3.1. Elementor is active on more than 10 million WordPress sites, and WordPress.org statistics show that those two impacted versions alone have been installed on more than 2 million sites. The flaw carries a high severity rating — a CVSS score of 8.8 out of 10.0 — and, at the time of reporting, had not been assigned a CVE identifier. Following responsible disclosure, the issue was addressed in Elementor 4.3.2, released earlier this week.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadTechnical root cause: Editor Events proxy and the REST API
Patchstack traced the problem to the Editor Events module. That module skipped CSRF protection for cookie-authenticated REST API requests whenever the literal string "elementor/v1/events/" appeared anywhere in the request URI. Because the request URI includes the query string and the query string is written by whoever composes the link, any REST request can opt itself out of CSRF protection simply by appending a seemingly harmless parameter containing that literal string.
Patchstack warned that the bypass applies to the entire REST API surface of a site, including WordPress core routes and routes exposed by other plugins. As a concrete example, an attacker could create an administrator account through the WordPress REST route "/wp/v2/users" by sending a link such as:
https://example.com/wp-json/wp/v2/users?_method=POST&username=csrfadmin&email=csrfadmin%40example.test&password=...&roles%5B%5D=administrator&x=elementor/v1/events/
In that pattern, the appended parameter (here shown as x=elementor/v1/events/) causes the Editor Events proxy to skip CSRF checks and lets the request proceed with the privileges of the logged-in user who clicked the link.
Patch, discovery, and which releases are safe
Elementor released version 4.3.2 earlier this week to address the vulnerability after it was responsibly disclosed. The security researcher who reported the bug is credited under the alias "Saggre." Elementor releases prior to 4.3.0 do not include the Editor Events proxy and therefore are not affected by this specific flaw.
What this means for technologists, site owners, and attackers
- Technologists and security teams: the clear immediate action in the advisory is to update to Elementor 4.3.2 as soon as possible. The vulnerability allows an attacker to create administrator accounts via the REST API when a privileged user clicks a crafted link.
- Site owners and procurement leaders: because Elementor is active on over 10 million sites and the two affected versions are installed on more than 2 million, administrators responsible for WordPress deployments should verify plugin versions and prioritize the 4.3.2 update across hosted and self-managed installations.
- Adversaries and threat actors: Patchstack's analysis shows a low-effort path to privilege escalation — a single link that leverages the query string to evade CSRF protections and invoke REST API actions such as creating users.
The chain of failure here is simple and specific: a literal string in the URI caused an entire CSRF protection check to be skipped, and because query strings are under the control of whoever composes a link, an attacker could turn an ordinary click into a site takeover. With a fix published in Elementor 4.3.2 and the researcher "Saggre" credited for discovery, the immediate test for operators is straightforward — confirm plugin version and apply the update without delay.
