Affected Systems
Elementor Website Builder WordPress plugin versions 4.3.0 and 4.3.1 only. Affects over 2 million active installations. Fixed in version 4.3.2.
Exploitation Status
No CVE assigned yet. No reports of active exploitation. Vulnerability publicly disclosed with technical details and proof-of-concept request structure available.
Business Impact
Unauthenticated attackers can create rogue administrator accounts by tricking a logged-in WordPress admin into clicking a malicious link (via email, chat, or comment). The CSRF bypass affects the entire WordPress REST API surface, including core routes and all installed plugins. CVSS 8.8. Attack requires no JavaScript, forms, or attacker-controlled pages—a plain anchor tag suffices. Given the 2 million+ affected sites and ease of exploitation, this poses significant risk to WordPress environments running vulnerable versions.
Urgency
🔴 Immediate
Recommended Actions
- Immediately update Elementor Website Builder plugin to version 4.3.2 or later on all WordPress sites
- Audit WordPress user accounts for unauthorized administrator accounts created between plugin versions 4.3.0/4.3.1 installation and patching
- Review WordPress access logs for suspicious REST API requests to /wp-json/wp/v2/users containing 'elementor/v1/events/' in query strings
- Educate WordPress administrators to avoid clicking unsolicited links until Elementor is patched
- If immediate patching is not possible, consider temporarily disabling Elementor plugin or restricting admin access to trusted networks only