Elementor CSRF Lets Attackers Mint WordPress Admins
BleepingComputer reports a cross-site request forgery flaw in the Elementor WordPress plugin that can let an unauthenticated attacker create administrator accounts. The issue matters because the result is not a one-time page change: it hands the attacker persistent full-site control.
The trick is to abuse a logged-in site admin’s browser so it sends a request Elementor accepts as legitimate. That request creates a new admin account for the attacker, so they no longer need the victim’s password or browser session to get back in.
For WordPress sites that rely on third-party plugins and browser-based administration, the exposure sits in account creation and not just login security. If an attacker can add their own admin, password rotation on the original account does not remove the foothold they created.
A cross-site request forgery (CSRF) vulnerability in the Elementor plugin for WordPress could allow an unauthenticated attacker to create administrator accounts.