CERT24Elementor CSRF flaw can enable site takeover after an administrator clicks a crafted linkLoading data…
CERT24Threat Observatory
Period

Elementor CSRF flaw can enable site takeover after an administrator clicks a crafted link

A high-severity cross-site request forgery (CSRF) flaw in the Elementor WordPress plugin could allow an unauthenticated attacker to create rogue administrator accounts and take control of a site after a logged-in WordPress user opens a crafted link. The flaw affects versions 4.3.0 and 4.3.1 and was fixed in version 4.3.2.

← Back to intelligence

Elementor CSRF flaw can enable site takeover after an administrator clicks a crafted link

A high-severity cross-site request forgery (CSRF) flaw in the Elementor WordPress plugin could allow an unauthenticated attacker to create rogue administrator accounts and take control of a site after a logged-in WordPress user opens a crafted link. The flaw affects versions 4.3.0 and 4.3.1 and was fixed in version 4.3.2.