Critical CSRF Flaw in Elementor Plugin Lets Attackers Hijack Sites with One Click

A high‑severity cross‑site request forgery (CSRF) vulnerability has been discovered in Elementor, the widely used WordPress site‑builder, which permits an unauthenticated attacker to spawn a new administrator account after a site manager clicks a maliciously crafted link.

Elementor runs on millions of WordPress installations around the globe, providing drag‑and‑drop design capabilities that make page creation easy for developers and non‑technical users alike. Its large market penetration means any defect in the plugin poses a serious risk to the broader WordPress ecosystem.

Analysis of the code reveals the problem originates from inadequate verification of request tokens during user‑creation operations. An attacker can place a harmful URL in an email or on social media; when a logged‑in admin follows the link, the request proceeds without the necessary nonce check, resulting in a rogue admin account being inserted into the site’s user database.

With administrator rights in hand, the attacker could install further malicious plugins, modify site content, steal data, or redirect visitors to phishing sites. Security researchers label the flaw as critical because it takes only a single click by a privileged user to compromise an entire website.

Elementor’s developers have issued an emergency update that introduces proper nonce validation and shuts down the unauthorized account‑creation endpoint. The company advises all site owners to install the patch without delay and to audit user accounts for any unexpected administrator entries that might have been created before the fix.

The finding underscores a persistent issue in the WordPress landscape: third‑party plugins frequently add vulnerabilities that can be weaponized at scale. Experts counsel regular plugin updates, periodic security reviews, and the deployment of security plugins capable of spotting and blocking suspicious requests. As WordPress continues to dominate the content‑management market, maintaining vigilance over plugin security remains vital to safeguard the millions of sites that depend on it.