importantSYS.SOURCE: The Hacker News• 2026-09-26T15:25:22+05:30

Elementor WordPress Plugin CSRF Vulnerability Enables Admin Account Takeover via Crafted Links

#vulnerability #wordpress #csrf #security

A high-severity CSRF vulnerability in Elementor WordPress plugin versions 4.3.0 and 4.3.1 allows attackers to create rogue admin accounts by tricking administrators into clicking crafted links, with a CVSS score of 8.8. The flaw was patched in version 4.3.2 and affects over 2 million sites, enabling unauthorized control through REST API requests.

Details have emerged about a high-severity security flaw in the Elementor Website Builder WordPress plugin that could be exploited by an unauthenticated attacker to create rogue administrator accounts and take control of a site.

The cross-site request forgery (CSRF) vulnerability, which has yet to be assigned a CVE identifier, carries a CVSS score of 8.8 out of 10.0. It only affects versions

Read original article

*** END OF TRANSMISSION ***

> CASCADIA SUBDUCTION ZONE OBSERVED TEARING APART, REVEALING NEW INSIGHTS INTO TECTONIC PLATE TERMINATION > INTERACTIVE DIGITAL AVATAR OF A JOURNALIST CREATED USING AI TECHNOLOGIES > ANALYZING THE BEHAVIORAL EFFECTS OF LLM WATERMARKING ON AI AGENT OPERATIONS > ADVANCED ATTACKERS EXPLOIT ORACLE PEOPLESOFT VULNERABILITY TO DEPLOY WEB SHELLS, BYPASSING WAFS > DEVELOPER ABANDONS GOOGLE PLAY STORE IN FAVOR OF F-DROID FOR CONVERSATIONS APP > ZERO TRUST IMPLEMENTATION FOR AI AGENTS: ADDRESSING VISIBILITY GAPS > PERSONAL REFLECTIONS ON ABANDONING AI IN SOFTWARE DEVELOPMENT > MICROSOFT AND PC MAKERS DISCONTINUE COPILOT+ PC BRANDING INITIATIVE > ELEMENTOR WORDPRESS PLUGIN CSRF VULNERABILITY ENABLES ADMIN ACCOUNT TAKEOVER VIA CRAFTED LINKS > APPLE CARDS: ORIGIN STORY, TECHNICAL HURDLES, AND PROJECT MANAGEMENT CHALLENGES> CASCADIA SUBDUCTION ZONE OBSERVED TEARING APART, REVEALING NEW INSIGHTS INTO TECTONIC PLATE TERMINATION > INTERACTIVE DIGITAL AVATAR OF A JOURNALIST CREATED USING AI TECHNOLOGIES > ANALYZING THE BEHAVIORAL EFFECTS OF LLM WATERMARKING ON AI AGENT OPERATIONS > ADVANCED ATTACKERS EXPLOIT ORACLE PEOPLESOFT VULNERABILITY TO DEPLOY WEB SHELLS, BYPASSING WAFS > DEVELOPER ABANDONS GOOGLE PLAY STORE IN FAVOR OF F-DROID FOR CONVERSATIONS APP > ZERO TRUST IMPLEMENTATION FOR AI AGENTS: ADDRESSING VISIBILITY GAPS > PERSONAL REFLECTIONS ON ABANDONING AI IN SOFTWARE DEVELOPMENT > MICROSOFT AND PC MAKERS DISCONTINUE COPILOT+ PC BRANDING INITIATIVE > ELEMENTOR WORDPRESS PLUGIN CSRF VULNERABILITY ENABLES ADMIN ACCOUNT TAKEOVER VIA CRAFTED LINKS > APPLE CARDS: ORIGIN STORY, TECHNICAL HURDLES, AND PROJECT MANAGEMENT CHALLENGES