Elementor CSRF Flaw Lets Attackers Create Admin Accounts

A cross-site request forgery vulnerability in Elementor, one of the most-installed page-builder plugins for WordPress, can allow an attacker to create administrator accounts on affected sites without holding any existing credentials, BleepingComputer reports.

CSRF flaws of this class work by tricking an authenticated administrator into executing a forged HTTP request: the attacker crafts a link or hosts a page that fires the request, an admin clicks or visits it while logged in, and the server acts on the session. In this case, the forged action creates a new administrator account, giving an attacker with no prior site access a foothold with the same privileges as the legitimate owner.

Elementor runs on tens of millions of WordPress installations; even a small unpatched percentage here is a lot of exposed sites in absolute terms.

Site owners should check the WordPress plugin manager for a pending Elementor update and apply it. If an update is not yet available, restricting access to the WordPress admin dashboard to known IP addresses reduces exposure: CSRF requires the administrator’s browser to be the delivery mechanism, so admin sessions that only originate from known addresses remove most of the practical attack surface. A CVE identifier has not been confirmed in public reporting.

WordPress plugin attacks that reach administrator access have been steady this year. Elementor Pro was exploited earlier in September to plant webshells, using a separate flaw. WordPress core CVE-2026-87902 reached active exploitation within 24 hours of disclosure earlier this week. A CVSS 10 authentication bypass in a payment plugin landed in September as well. The pattern is less surprising than it used to be, which is part of the problem.