🟠High: Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link
-
Details have emerged about a high-severity security flaw in the Elementor Website Builder WordPress plugin that could allow an unauthenticated attacker to create rogue administrator accounts and seize control of a site.
The issue is a cross-site request forgery (CSRF) vulnerability, which has not yet been assigned a CVE identifier and carries a CVSS score of 8.8 out of 10.0. It only affects certain versions of the plugin.
Successful exploitation requires an administrator to click a crafted link, after which the attacker can establish a malicious admin account and take over the affected website.
Affected users should confirm whether their installed version is impacted and update to a patched release as soon as one is available.
- Watch for unexpected administrator accounts
- Review recent admin activity and plugin versions
- Apply vendor updates promptly once released
Until a fix is available, treat unsolicited links received by site administrators with heightened caution.
Source: The Hacker News
Has your organization already checked its Elementor version and audited for suspicious admin accounts?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login