Elementor has patched a security vulnerability in its widely used WordPress page builder that could allow an attacker to trick a logged-in administrator into creating a new administrator account.
The flaw, tracked as CVE-2026-62062, affects Elementor versions 4.3.0 and 4.3.1 and was fixed in version 4.3.2, released September 24.
Security firm Patchstack assigned the vulnerability a CVSS score of 8.8 and classified it as cross-site request forgery, or CSRF. This type of vulnerability can cause a logged-in user’s browser to perform an action they did not intend.
In this case, an attacker could send a specially crafted link through an email, chat message, comment or another channel. If a logged-in WordPress administrator clicked the link, it could use that administrator’s existing permissions to perform actions on the site. Patchstack demonstrated the attack by creating a second administrator account.
How the flaw worked
The issue was introduced in Elementor 4.3.0 as part of an Editor Events feature. According to Patchstack, Elementor attempted to identify certain requests by searching the full web address for a specific string. Because an attacker could add that same text to a crafted URL, the request could bypass a WordPress security check intended to confirm that an action was deliberately initiated by the logged-in user.
The vulnerability didn’t give an attacker more permissions than the victim already had. Its impact therefore depended on who clicked the link. A WordPress admin could potentially be made to perform administrator-level actions, while a lower-privileged user would have fewer available permissions.
Patchstack said the issue could affect other WordPress or plugin functions accessible to the logged-in account, not only the demonstrated administrator-account creation.
Update Elementor to 4.3.2 or later
Elementor fixed the vulnerability in version 4.3.2 changing how it determines whether a request belongs to its own feature, preventing attacker-controlled text elsewhere in the URL from triggering the bypass. WordPress administrators running Elementor 4.3.0 or 4.3.1 should update to 4.3.2 or later.
Leave a Reply