Elementor 4.3.0 and 4.3.1: CSRF Enables Administrator Account Creation via a Flawed REST Route Check

1. Basic Information

• Title: Cross-Site Request Forgery in Elementor Plugin Affecting 2 Million+ Sites
• Source: Patchstack
• Published: September 25, 2026
• Updated: N/A
• Severity: critical
• Severity Basis: When an authenticated administrator opens a crafted link, an attacker can create an administrator account on sites running Elementor 4.3.0 or 4.3.1 with Editor Events enabled. Patchstack rates this as CVSS 8.8, but we assess it as critical due to the impact on site administrative privileges. No active exploitation has been reported in the wild.
• Original: Cross-Site Request Forgery in Elementor Plugin Affecting 2 Million+ Sites
• Related Sources: BleepingComputer: Elementor WordPress flaw lets attackers create admin accounts
• Revision Notes: Clarified the omission of nonce validation and authorization differences, the scope of success in research environments, and the ATT&CK mapping for administrator creation.

2. Overview

The Editor Events experimental feature in Elementor bypassed REST API nonce validation via a URL partial match, allowing attackers to create an administrator account simply by having an administrator open a crafted link.

3. Attack Flow

The following outlines the validation and implementation paths indicated by public sources. Refer to Attack Success Determination for the scope of observation in real-world environments.

One-Click Administrator Account Creation

1. An attacker constructs a single URL combining a REST route, a fake Elementor path, _method=POST, and an administrator creation payload.
2. A WordPress administrator opens the link in a browser where they are currently logged in.
3. Elementor mistakes the partial match within the REQUEST_URI for a legitimate event route and returns true in the authentication filter, thereby bypassing WordPress REST nonce validation.
4. The WordPress REST API processes the user creation route using the victim's cookie authentication and administrator privileges, creating an attacker-controlled administrator account.

4. Attacker Position and Execution Location

• The attacker sends the link from an external source, and the request itself is sent to WordPress from the victim administrator's browser.
• The side effect occurs within the WordPress REST API under the victim's authenticated privileges.

5. Victim and Administrator Perspective

Victim

• When an authenticated administrator opens a crafted link, a JSON response containing user information may be displayed.

Administrator

• Unintended administrator accounts or REST API write operations using existing administrator sessions appear. Log coverage depends on the audit configuration.

6. Conditions for Success and Failure

Success Conditions

• Elementor 4.3.0 or 4.3.1 must be installed with the Editor Events experimental feature enabled.
• The administrator must open the crafted URL while logged into WordPress.

Failure Conditions and Mitigation Measures

• Update Elementor to version 4.3.2 or later.
• Monitoring administrator creation or permission changes is a supplementary measure for early detection. Alerts or disabling accounts after creation do not prevent CSRF itself.

7. Outcome upon Success

• An administrator account for the attacker is created.
• Inference: Depending on the acquired administrative privileges and site-level restrictions, this may lead to subsequent compromises such as content defacement or plugin manipulation. These subsequent actions are distinct from the validation results in the proof of concept.

8. Observable Logs

The following are investigation perspectives for your organization. Not all items indicate that actual damage has been observed.

• Email: Check the source of the crafted link and the click timestamp.
• Web / Proxy / WAF: Review web server, reverse proxy, or WAF request logs for GET requests containing elementor/v1/events/ and _method=POST, as well as requests to user creation routes.
• Endpoint / EDR: Check for WordPress/PHP process and plugin modifications, as well as web shell installation.
• Identity / IdP: Check for new administrators, sessions, and password changes.
• SaaS / Cloud: Check WordPress audit logs and hosting management configuration changes.
• Network: Check for abnormal REST write operations originating from the administrator browser IP followed by subsequent use of the newly created account.

9. Attack Success Determination

Confirmed in Public Information

• User Interaction Confirmed: Public Information: the proof of concept described by Patchstack confirmed the action of an administrator opening a link. (Scope: Research environment. In-the-wild exploitation unconfirmed)
• Subsequent Compromise Confirmed: Public Information: The same proof of concept confirmed the creation of a new administrator account. (Scope: WordPress administrator privileges in a research environment)

10. Investigation Playbook

The following are investigation and response recommendations for organizations based on public information:

• Starting Point: Initiate investigations upon detecting unintended administrator creation, access to crafted links, or the presence of vulnerable versions.
• Initial Response: Verify the Elementor version, the enabled state of Editor Events, and the administrator session status during the operation.
• Endpoint: Preserve processes, files, services, persistence mechanisms, and EDR telemetry.
• Identity / Cloud: Check tokens, keys, logins, and SaaS/cloud audit logs.
• Follow-up Verification: Track information theft, lateral movement, additional payloads, and configuration changes.
• Containment: Update to version 4.3.2 or later, investigate and remove unauthorized accounts and modifications, revoke sessions for compromised accounts, and rotate exposed credentials.
• Outcome Classification: Distinguish link delivery, the administrator's click, REST request processing, unauthorized account creation, and subsequent account use.

11. Defense and Detection Ideas

• Single Events: Investigate unintended administrator creation or requests containing fake Elementor paths and _method=POST.
• Timeline: Correlate link access, REST API requests, administrator creation, and the subsequent use of created accounts in a chronological timeline.
• Hunting: Cross-reference the affected period and asset inventory to retroactively hunt for identical IOCs and behaviors.
• Log Deficiencies: A lack of necessary records limits the ability to determine success stages. The absence of logs does not necessarily mean execution did not occur.
• Prioritized Mitigations: Prioritize patching, least privilege, monitoring unauthorized administrator account creation, and retaining audit logs.

12. Facts, Inference, and Hypothesis

Facts

• The affected Editor Events module is present in Elementor 4.3.0 and 4.3.1. It is enabled by default on sites whose first Elementor installation was version 3.32.0 or later. This hidden experiment does not appear on the Experiments screen.
• Elementor registers a filter callback on rest_authentication_errors at priority 0, returning true and bypassing WordPress REST nonce validation whenever the attacker-controlled REQUEST_URI contains elementor/v1/events/ anywhere within it.
• Attackers can inject _method=POST and a fake Elementor path into GET request queries, sending administrator creation payloads to the actual /wp-json/wp/v2/users route.
• In-browser JavaScript or forms on attacker sites are not required; opening the link displays a JSON response.
• Version 4.3.2 uses resolved rest_route checks to verify that requests begin with permitted routes.
• The REST nonce bypass does not disable authorization for all routes, but rather produces side effects within the scope of REST the victim's existing permissions. Directing an administrator leads to administrator creation.

Inference

No additional inferences.

Hypothesis

No additional hypotheses. Unverified items are listed in Unknowns and Additional Investigation.

13. MITRE ATT&CK Mapping

ID	Technique	Confidence	Basis
T1204.001	User Execution: Malicious Link	high	Patchstack's verification requires an authenticated administrator to open a crafted link.
T1136	Create Account	high	Patchstack verified the creation of a WordPress administrator account. Because there is no evidence it is a cloud account, it is mapped to the parent technique.

14. Unknowns and Additional Investigation

• The presence of in-the-wild exploitation and the number of operational deployments of vulnerable versions 4.3.0 and 4.3.1.
• The environment-specific impact of other REST endpoints, including those added by third-party plugins, for each victim role.

15. Impact on SOCs and Organizations

WordPress sites using Elementor 4.3.0 or 4.3.1 must be updated to version 4.3.2 or later, and organizations should not rely solely on operational policies preventing administrators from opening external links prior to patching. SOCs should correlate REST operations where GET requests within administrator sessions were overridden to POST with subsequent administrator creation.

16. Summary by Persona

• SOC: Correlate administrator session _method=POST, fake Elementor paths, /wp-json/wp/v2/users, and new administrator creation.
• Administrators: Update Elementor to version 4.3.2 or later, audit for suspicious administrators, force logouts, and rotate credentials.
• Users: Avoid opening suspicious links while logged into administrative dashboards, and notify administrators if an unintended JSON screen appears.