A security flaw in the popular Elementor Website Builder plugin for WordPress could allow attackers to create administrator accounts on vulnerable websites. The cross-site request forgery (CSRF) vulnerability can be exploited by tricking a logged-in WordPress administrator into opening a specially crafted malicious link.
Elementor is one of the most widely used WordPress plugins, with the Website Builder active on around 10 million websites. The newly discovered vulnerability affects Elementor versions 4.3.0 and 4.3.1, which together are believed to be installed on up to 2 million sites.
The vulnerability was reported to Elementor by security firm Patchstack on September 22 after it was discovered by a bug hunter known as “Saggre.” Elementor released a fix two days later with version 4.3.2.
According to Patchstack, the problem is linked to Elementor’s Editor Events module. The module checks the raw request URI for a specific path and can bypass WordPress REST API nonce validation when that path is included in a request. Because attackers can control query parameters in the request, they can manipulate the URL to target other REST API endpoints.
This makes it possible to launch a one-click attack against a logged-in administrator. If the administrator opens the malicious link while authenticated, the request can be processed using their existing privileges and could result in the creation of a new administrator account controlled by the attacker.
The attack does not require JavaScript, an attacker-controlled website or a form submission. Patchstack says the malicious link could instead be delivered through common channels such as email, chat messages or comments on a website.
Elementor versions older than 4.3.0 do not contain the affected Editor Events proxy, but those versions can still contain other security vulnerabilities, including flaws that have previously been exploited in attacks against WordPress sites.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
WordPress administrators using Elementor 4.3.0 or 4.3.1 should update to version 4.3.2 as soon as possible. The patched release prevents attackers from using the query-string technique to bypass the security protection.
