A critical security flaw in Elementor, the most widely used page builder for WordPress, lets an attacker take over a site with a single clicked link. Elementor runs on more than 10 million active sites.
What happened
The flaw is a cross-site request forgery (CSRF) bug, a trick where a malicious link forces a logged-in user’s browser to carry out an action they never intended. According to a Patchstack advisory, Elementor’s Editor Events feature checked only whether a request’s URL contained a specific text string to decide whether to skip its normal security check. Since anyone can add that text string to a link, an attacker could bypass the protection entirely.
The result: a link an attacker sends by email, chat message, or comment can make a logged-in user’s browser fire off any action their WordPress account is allowed to perform. No JavaScript, form, or attacker-controlled webpage is needed, just an ordinary link.
Patchstack says that on a standard WordPress installation, an administrator who clicks the link ends up unknowingly creating a second administrator account for the attacker. That gives the attacker full control of the site.
The bug carries a CVSS severity score of 8.8, out of a maximum of 10, and was reported to Patchstack by a researcher known as Saggre.
Who is affected
Only two versions of Elementor are vulnerable: 4.3.0 and 4.3.1. If you installed or updated Elementor while those versions were current, your site is exposed until you update.
What to do
Update Elementor to version 4.3.2 or later right away. Check your WordPress dashboard under Plugins for a pending update, or update manually if automatic updates are turned off.
If you run a firewall or security plugin, check whether it already blocks this attack pattern. Patchstack customers are covered by mitigation rules the company has already issued.
End of article