Severe CSRF Flaw in Elementor Lets Attackers Hijack Sites With One Click

A high‑severity cross‑site request forgery (CSRF) flaw has been uncovered in Elementor, the widely used WordPress page‑builder, which enables an unauthenticated attacker to spin up a new administrator account after a site manager clicks a maliciously crafted link.

Elementor runs on millions of WordPress installations worldwide, providing drag‑and‑drop design capabilities that make page creation easy for developers and non‑technical users alike. Because of its massive market share, any security weakness in the plugin poses a considerable risk to the broader WordPress ecosystem.

Technical review indicates the problem originates from inadequate verification of request tokens during user‑creation operations. An attacker can place a harmful URL in an email or on social media; when a logged‑in admin follows that link, the request bypasses the required nonce check and a rogue admin account is inserted into the site’s user database.

With administrator rights in hand, the intruder can install further malicious plugins, modify site content, steal data, or redirect visitors to phishing sites. Security researchers have labeled the vulnerability as critical because it can compromise an entire website with just a single click from a privileged user.

Elementor’s developers have issued an emergency patch that introduces proper nonce validation and blocks the unauthorized account‑creation endpoint. The company advises all site owners to apply the update without delay and to audit user accounts for any unexpected administrator entries that might have been created before the fix.

The finding underscores a persistent issue in the WordPress landscape: third‑party plugins often bring in exploitable flaws at scale. Experts counsel regular plugin updates, periodic security audits, and the deployment of security plugins capable of spotting and blocking suspicious requests. As WordPress continues to dominate the content‑management market, maintaining vigilance over plugin security remains vital for protecting the millions of sites that depend on it.