Overview
- Security researchers found that Elementor's Editor Events proxy treated any request URI containing the literal string "elementor/v1/events/" as trusted, which bypassed WordPress REST nonce checks and allowed cookie-authenticated REST write actions to run under an administrator's session.
- The flaw affects only Elementor versions 4.3.0 and 4.3.1, which WordPress.org statistics show are installed on up to about 2 million sites out of roughly 10 million active Elementor installs.
- Patchstack says researcher "Saggre" reported the issue on September 22 and Elementor released a fix in version 4.3.2 on September 24, so the immediate development is that a patch is available but many sites remain unpatched.
- An attacker can exploit the bug with a single crafted link that appends _method=POST and the fake Elementor path to a REST route (for example /wp-json/wp/v2/users) so that an administrator who clicks the link unwittingly creates a rogue admin account; the attack needs no JavaScript or attacker-controlled page.
- Operators should update to Elementor 4.3.2, audit for unexpected administrator accounts, revoke administrator sessions and API tokens, rotate credentials, and search server or proxy logs for GET requests containing "elementor/v1/events/" together with "_method=POST" to detect possible exploitation.