Critical Elementor CSRF Flaw Exposes 2 Million WordPress Sites to Full Takeover

Elementor, the page-builder plugin installed on over 10 million WordPress sites, has a critical vulnerability that lets unauthenticated attackers take full administrative control. Tracked as CVE-2026-62062 with a CVSS score of 8.8, the flaw affects versions 4.3.0 and 4.3.1 and bypasses WordPress’s REST API protections, so a complete site takeover takes just one click from an administrator.

WordPress.org lists more than 2 million active installs across the two affected versions. Security firm Patchstack and researcher “Saggre” coordinated the disclosure, and Elementor shipped a fix in version 4.3.2. Sites on delayed auto-update schedules remain exposed until they patch.

How WordPress blocks CSRF attacks on its REST API

CSRF tricks a logged-in user’s browser into sending a request they never intended to send. Because the WordPress REST API relies on cookie-based authentication, it’s naturally exposed to this: if an administrator is logged into their dashboard and visits a malicious page, that page can force their browser to send a forged request to the site’s REST API, such as deleting a post or creating a new user.

WordPress defends against this with a token system called “nonces” (numbers used once). Any state-changing REST API request made via cookies (POST, PUT, DELETE) must carry a valid wp_rest nonce, generated for that specific user and action. Without a valid nonce, WordPress core rejects the request with a 403 error, which stops the CSRF attack.

The root cause: a string-matching bug in Elementor

The vulnerability doesn’t live in WordPress core. It’s in a feature Elementor added called the Editor Events module, which proxies certain frontend interactions back to the server for analytics and state tracking.

To keep its own endpoints from conflicting with norElementor CSRF flawmal nonce checks, Elementor built a logic gate that bypasses nonce validation for requests aimed at the Editor Events proxy. The bug is in how that gate parses the incoming request.

Instead of checking which WordPress route is being accessed, the Editor Events module scans the raw REQUEST_URI server variable. In PHP, REQUEST_URI includes not just the URL path but the entire query string. The module skips WordPress core’s nonce check whenever the literal string elementor/v1/events/ shows up anywhere in that raw URI, including inside the query string.

Since the query string is entirely controlled by whoever writes the link, any REST API request on the site, including core WordPress routes and routes from unrelated plugins, can opt out of CSRF protection just by appending a dummy parameter containing that trigger string.

How the attack works: weaponizing the query string

This turns into a blanket CSRF bypass for the site’s entire REST API. An attacker doesn’t need to touch an Elementor endpoint at all; they can go straight for the most powerful one available: the native WordPress user-creation route.

Researchers have built a working proof of concept that forges a new administrator account without the victim submitting a form, running JavaScript, or visiting an attacker-controlled page. The attack is just a standard HTML anchor tag (<a href="...">) dropped into an email, a Slack or Discord message, or a forum comment.

When a logged-in administrator clicks the link, their browser sends a GET request carrying their auth cookies. The payload is built to make the REST API treat it as a POST request while also triggering Elementor’s bypass:

http

https://example.com/wp-json/wp/v2/users
?_method=POST
&username=rogue_admin
&email=attacker%40example.com
&password=SuperSecretPassword123!
&roles%5B%5D=administrator
&x=elementor/v1/events/

Breaking down the payload:

1. /wp-json/wp/v2/users: the standard WordPress endpoint for managing users.
2. _method=POST: clicking a link sends a GET request, so this parameter tells the REST API to treat the request as a POST, which is required to create a resource.
3. roles%5B%5D=administrator: assigns the new user administrator privileges.
4. x=elementor/v1/events/: the trigger string. Elementor sees it in the query parameters and tells WordPress to skip nonce validation.

With the nonce check skipped, WordPress processes the request as authenticated and authorized, creating the rogue admin account.

The threat model: no attacker infrastructure required

What sets CVE-2026-62062 apart is that it needs no attacker infrastructure at all. Traditional CSRF attacks usually require hosting a malicious page with JavaScript or a hidden auto-submitting form. Here, the payload is a plain-text hyperlink, which makes it easy to disguise in a support ticket reply, an invoice email, or a comment on a developer blog.

Once an administrator clicks it, the attacker has persistent, high-privileged server access. From there they can plant backdoors, inject SEO spam, pull customer data through WooCommerce, or move laterally to other sites on the same shared server.

Incident response and remediation

Webmasters, developers, and managed WordPress hosts need to act now. Because the exploit leaves a distinct footprint, follow this triage:

1. Patch immediately

Elementor fixed the vulnerability in version 4.3.2, released earlier this week. Check your installed version and force an update to 4.3.2 or later. Versions before 4.3.0 don’t include the Editor Events proxy and aren’t affected.

2. Audit the user registry

Go to Users > All Users in the WordPress dashboard and sort by registration date. Look for unfamiliar accounts created in the last 72 hours, especially ones with the Administrator role. Delete any suspicious accounts immediately and rotate all legitimate administrator passwords.

3. Review audit logs

If you run WP Activity Log, Wordfence, or Solid Security, check the REST API logs for unauthorized POST requests to /wp-json/wp/v2/users. Watch for requests from your own administrators’ IP addresses; that pattern means their browser was tricked into firing the payload.

4. Add WAF rules

On enterprise setups using Cloudflare, AWS WAF, or Sucuri, add rules that inspect incoming REST API requests. Any request to /wp-json/ that lacks a valid X-WP-Nonce header but contains elementor/v1/events/ in the query string or path should get dropped at the edge, before it reaches WordPress’s PHP layer.

The lesson: don’t parse raw URIs for security decisions

CVE-2026-62062 is a case study in a common anti-pattern: matching raw HTTP requests against a string instead of validating the actual route. A URI is a composite of the path, query string, and sometimes URL-encoded fragments, and using strpos() or a basic regex against the whole REQUEST_URI is risky. Security checks need to parse the request into its actual routing components and validate the specific endpoint being called, not scan for a keyword anywhere in the URL.

Nonce validation is WordPress’s main defense against forged REST API requests, and this bug shows how one plugin’s logic error can undercut it site-wide. Keep automatic updates on, and check any code that touches request parsing before it ships.