Up to 2 million WordPress sites were running the vulnerable Elementor versions 4.3.0 and 4.3.1, according to WordPress.org statistics — and on default installations a single opened link could let an attacker create an administrator account under their control.
How the Editor Events proxy produced a CSRF bypass
Security firm Patchstack traced the flaw to Elementor’s Editor Events module. According to Patchstack’s analysis, the module checks the raw request URI for the elementor/v1/events/ path and, when that string is present, bypasses WordPress’s REST nonce validation. Because the URI can also contain attacker-controlled query parameters, an attacker can append the Editor Events path to requests targeting other REST endpoints and cause a logged-in user’s session to execute those actions with their existing privileges.
One-click, no JavaScript — how exploits would be delivered
Patchstack warned the flaw enables “one-click attacks” against a logged-in administrator. In their words: “One link, opened by a logged-in WordPress user, makes that user carry out any REST API action their account is permitted to perform.” The firm added the attack does not require JavaScript, an attacker-controlled webpage, or a submitted form; the malicious link can be delivered via email, a chat message, or a comment on the site. On default installations, Patchstack said, the outcome can be the creation of an administrator account under the attacker’s control.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildScope: millions of installs, limited to two versions
The Elementor Website Builder is installed on roughly 10 million websites. The CSRF flaw affects only plugin versions 4.3.0 and 4.3.1; WordPress.org statistics indicate those two versions are used by up to 2 million sites. The vulnerability had not received a public identifier at the time of Patchstack’s disclosure.
Discovery, disclosure, and the available fix
Patchstack reported the vulnerability to the Elementor team on September 22 after receiving the report from bug hunter “Saggre.” Elementor released a patched plugin two days later: version 4.3.2, which Patchstack says prevents attackers from triggering the bypass through the query string. Users of the plugin are recommended to upgrade to Elementor 4.3.2 as soon as possible.
Older releases and additional risk vectors
Patchstack noted that Elementor releases prior to 4.3.0 do not contain the affected Editor Events proxy, but those older versions remain vulnerable to other flaws — “some of which are already actively exploited,” the firm said. That means upgrading to 4.3.2 closes the specific CSRF bypass described here but does not change the fact that other versions may carry different, real risks.
What this means for site owners, logged-in administrators, and attackers
- Site owners and administrators: Sites running Elementor 4.3.0 or 4.3.1 should install 4.3.2 immediately to block the query-string bypass identified by Patchstack.
- Logged-in administrators and editors: The threat model here depends on authenticated sessions — attackers need only trick an already logged-in user into opening one link to trigger permitted REST API actions, so vigilance around unsolicited links and comments is critical.
- Attackers and threat actors: The vulnerability’s mechanics — bypassing REST nonce validation via a crafted URI — make it particularly attractive for low-effort, high-impact abuse because exploits can be delivered through ordinary communication channels without requiring client-side scripting.
The technical fix shipped quickly after disclosure: Elementor 4.3.2 blocks the specific query-string trigger that allowed the bypass. The sharper question left by these facts is operational: how many of the up-to-2-million sites running the affected builds will install the update promptly, and how many remain exposed to either this specific bypass or the other known, actively exploited flaws in older releases? Until those updates are broadly applied, the vector described by Patchstack — one link, opened by a logged-in user, yielding administrative control — remains a present and verifiable risk.
