A cross-site request forgery flaw in the Elementor Website Builder plugin let a single clicked link hand an attacker a new administrator account on any WordPress site running the wrong two versions of the tool.
What happened
Elementor 4.3.0 and 4.3.1 shipped an Editor Events feature that registered a filter on WordPress’s rest_authentication_errors hook. Per the vulnerability record published by Patchstack, that filter approved any REST API request whose URL contained the string elementor/v1/events/ anywhere in it, and skipped WordPress’s nonce check when it did. Because the check read the raw request URI rather than the actual route, an attacker could append that string to a request aimed at a different endpoint entirely, including the one that creates new users. Patchstack assigned the flaw CVE-2026-62062, a CVSS 8.8 CSRF vulnerability, credited to researcher Saggre. The plugin runs on more than 10 million sites, with the two affected versions active on more than 2 million. Elementor shipped 4.3.2, checking the resolved route instead of the raw URI.
Why it matters
The attack needs no JavaScript and no form submission: a link sent by email, chat, or comment is enough, and it only takes one click from a logged-in administrator. Because the flawed filter sat on a shared authentication hook rather than inside Elementor’s own routes, the bypass covered the entire REST API surface of the site, WordPress core included. A page-builder update became a full site-takeover primitive the moment an admin opened the wrong link.
The insight
The recurring failure is not the CSRF bug itself but where the trust decision sat: a plugin’s global authentication filter can silently override protections meant for the whole API surface, not just its own corner of it, a pattern CyberTech also flagged in a recent unauthenticated path-traversal bug in WordPress core. Sites on 4.3.0 or 4.3.1 should update to 4.3.2 now. The gap between patch availability and real-world adoption, the subject of CyberTech’s reporting on federal patch deadlines outrunning adoption, applies to plugin ecosystems too.
Source: Patchstack
