<![CDATA[Elementor WordPress flaw lets attackers create admin accounts]]>A cross-site request forgery (CSRF) vulnerability has been identified in the Elementor plugin for WordPress that could allow an unauthenticated attacker to create administrator accounts. According to the report, the flaw can be triggered without authentication, giving attackers a path to gain elevated privileges on affected sites.

The vulnerability affects installations running the Elementor plugin. Administrators are advised to check their plugin version and update to the latest release as soon as possible to close the attack vector. Sites that cannot update immediately should consider additional protections such as restricting access to the WordPress admin area or deploying a web application firewall rule to block CSRF-style requests.

Key points to keep in mind:

  • The issue is a CSRF flaw in the Elementor plugin
  • Exploitation could result in the creation of administrator accounts
  • The attack does not require authentication
  • Updating the plugin is the primary mitigation

No specific CVE identifier was provided in the source article.

Source: BleepingComputer

Has your organization already patched Elementor, or are you relying on compensating controls in the meantime?

]]>https://xploitlk.com/topic/464/elementor-wordpress-flaw-lets-attackers-create-admin-accountsRSS for NodeTue, 27 Oct 2026 10:35:43 GMTFri, 25 Sep 2026 18:30:21 GMT60