Elementor WordPress Flaw Could Let Attackers Create Admin Accounts

An Elementor WordPress flaw could let attackers create administrator accounts after a logged-in site administrator opens a malicious link. The issue affects Elementor versions 4.3.0 and 4.3.1. Elementor fixed it in version 4.3.2.

Malicious Link Uses an Administrator’s Session

The flaw involves cross-site request forgery, or CSRF. An attacker does not need an account on the target website. Instead, they must persuade someone who is already logged in to open a crafted link.

The request then runs through that person’s authenticated WordPress session. As a result, it can perform actions that their account permits. If the victim has administrator privileges, the attacker can create a new administrator account on a default installation.

According to security firm Patchstack, an attacker could deliver the link through an email, chat message or website comment. The attack does not require a separate malicious webpage, JavaScript or a form submission.

Elementor Checks the Wrong Part of the Request

Patchstack traced the Elementor WordPress flaw to the plugin’s Editor Events module. The module checked the raw request address for an Elementor events path before bypassing WordPress’s REST API nonce validation.

However, an attacker could place that path inside a query parameter while directing the request to a different REST API endpoint. Elementor would then skip the validation check for a request outside the intended events route.

The attack still depends on a logged-in user opening the link. The actions available to the attacker also depend on that user’s permissions. Therefore, an administrator account presents the most serious case.

Version 4.3.2 Closes the Bypass

A researcher known as Saggre reported the issue to Patchstack, which notified Elementor on September 22. Elementor released version 4.3.2 on September 24.

The update checks the resolved REST API route instead of searching the raw request address. Consequently, an attacker can no longer trigger the bypass by adding the events path to a query string.

Site owners using Elementor 4.3.0 or 4.3.1 should update to version 4.3.2 or later. Earlier releases do not contain this particular vulnerable module, but they may have other security flaws.