Elementor Website Builder CSRF Flaw (CVE-2026-62062) Allows Attacker-Controlled WordPress Admin Account Creation (v4.3.0-4.3.1)

Key facts

Detection coverage

As of 2026-09-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2672 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Elementor CVE-2026-62062 Nonce-Bypass CSRF Exploit Request — SPL

Detects the core CVE-2026-62062 exploit request: an HTTP request whose query string simultaneously targets the WordPress core user-management REST route (/wp-json/wp/v2/users or ?rest_route=/wp/v2/users) and contains the attacker-abused Elementor Editor Events trigger substring (elementor/v1/events/), used to bypass the rest_authentication_errors nonce check. Flags requests that additionally carry the _method=POST override or a roles[]=administrator payload — the documented one-click admin-account-creation link pattern.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1566.002, T1204.001, T1556, T1211, T1595.002, T1588.005
• Data sources: apache_nginx_access_logs, azure_app_service_http_logs, waf_cdn_logs, wordpress_rest_api_access_logs
• Severity: high
• Confidence: high

Splunk SPL

index=web (sourcetype=access_combined OR sourcetype=nginx:plus:kv OR sourcetype=apache:access)
| eval uri_query=coalesce(cs_uri_query, query_string, uri_query, _raw)
| rex field=uri_query "(?i)(?<method_override>_method=POST)"
| rex field=uri_query "(?i)(?<admin_role_param>roles(%5B%5D|\[\])?=administrator)"
| rex field=uri_query "(?i)(?<events_trigger>elementor(%2F|/)v1(%2F|/)events(%2F|/))"
| where (match(uri_path, "(?i)wp-json/wp/v2/users") OR match(uri_query, "(?i)rest_route=.*wp(\/|%2F)v2(\/|%2F)users")) AND isnotnull(events_trigger)
| eval has_nonce=if(match(_raw, "(?i)X-WP-Nonce:\s*\S+"), 1, 0)
| eval risk_indicator=if(isnotnull(admin_role_param) OR isnotnull(method_override), "high", "medium")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_query) as sample_query_strings values(status) as status_codes by clientip host uri_path risk_indicator has_nonce
| where risk_indicator="high" OR has_nonce=0
| sort -count

Microsoft KQL

AppServiceHTTPLogs
| where TimeGenerated > ago(24h)
| where CsUriStem has "wp-json" or CsUriQuery has "rest_route"
| where CsUriQuery has_cs "elementor/v1/events" or CsUriQuery has_cs "elementor%2Fv1%2Fevents"
| where CsUriStem has "wp/v2/users" or CsUriQuery has "wp/v2/users" or CsUriQuery has "wp%2Fv2%2Fusers"
| extend HasMethodOverride = CsUriQuery has "_method=POST"
| extend HasAdminRole = CsUriQuery has "roles" and CsUriQuery has "administrator"
| where HasMethodOverride or HasAdminRole
| project TimeGenerated, CIp, CsMethod, CsUriStem, CsUriQuery, ScStatus, UserAgent, HasMethodOverride, HasAdminRole
| sort by TimeGenerated desc

Sigma

title: Elementor CVE-2026-62062 CSRF Nonce-Bypass Exploit Request
id: 7f1a3e2c-4b6d-4e8a-9c31-2a5d7f9e1b40
status: experimental
description: Detects an HTTP request combining the WordPress core user-creation REST route with the Elementor Editor Events nonce-bypass trigger substring, indicative of CVE-2026-62062 exploitation attempts.
references:
  - https://patchstack.com/articles/cross-site-request-forgery-in-elementor-plugin-affecting-2-million-sites/
  - https://nvd.nist.gov/vuln/detail/CVE-2026-62062
author: Threadlinqs Team
date: 2026-09-26
tags:
  - attack.initial-access
  - attack.t1190
  - attack.t1566.002
  - attack.execution
  - attack.t1204.001
  - attack.credential-access
  - attack.t1556
  - attack.defense-evasion
  - attack.t1211
  - attack.reconnaissance
  - attack.t1595.002
  - attack.resource-development
  - attack.t1588.005
  - cve.2026.62062
logsource:
  category: webserver
detection:
  selection_route:
    cs-uri-stem|contains: 'wp-json/wp/v2/users'
  selection_route_alt:
    cs-uri-query|contains: 'rest_route=/wp/v2/users'
  selection_trigger:
    cs-uri-query|contains:
      - 'elementor/v1/events/'
      - 'elementor%2Fv1%2Fevents%2F'
  selection_abuse:
    cs-uri-query|contains:
      - '_method=POST'
      - 'roles[]=administrator'
      - 'roles%5B%5D=administrator'
  condition: (selection_route or selection_route_alt) and selection_trigger and selection_abuse
falsepositives:
  - Elementor's own legitimate Editor Events analytics traffic to its own /wp-json/elementor/v1/events/ proxy route (will not also target wp/v2/users)
  - Authorized penetration testers or the vendor validating the CVE-2026-62062 patch against a staging/lab environment
level: high

Known false positives:

• Elementor's own legitimate Editor Events analytics traffic to its own /wp-json/elementor/v1/events/ proxy (will not also target wp/v2/users or wp-json/wp/v2/users)
• Authorized penetration testers or the vendor validating the CVE-2026-62062 patch against a staging/lab environment

Tuning notes: Scope the wp/v2/users and elementor/v1/events/ substrings to your actual WordPress base path if running multisite/subdirectory installs; allowlist known QA/patch-verification source IPs; raise severity to critical when the request also lacks an X-WP-Nonce header or originates from outside your organization's expected CDN/egress ranges.

• 🔒 [indicator] CVE-2026-62062 Nonce-Bypass CSRF Exploit Request — KQL · unlock with TL Creds
• 🔒 Rogue WordPress Administrator Account Created via REST API — KQL · unlock with TL Creds
• 🔒 Privileged Consolidation Activity Shortly After Rogue Admin Creation — KQL · unlock with TL Creds
• 🔒 [indicator] CVE-2026-62062 Nonce-Bypass CSRF Exploit Request — Sigma · unlock with TL Creds
• 🔒 Rogue WordPress Administrator Account Created via REST API — Sigma · unlock with TL Creds
• 🔒 Privileged Consolidation Activity Shortly After Rogue Admin Creation — Sigma · unlock with TL Creds
• 🔒 Rogue WordPress Administrator Account Created via REST API — SPL · unlock with TL Creds
• 🔒 Privileged Consolidation Activity Shortly After Rogue Admin Creation — SPL · unlock with TL Creds

Indicators of compromise

As of 2026-09-27, Threadlinqs Intelligence tracks 18 indicators of compromise for TL-2026-2672.

Sample indicators (1 of 18)

• File hash: 5e6d1f3cd9624535c4112235063400716344761d

Defanged, TLP:CLEAR. Full set of 18 indicators: unlock with TL Creds.

Technical analysis

Elementor patched the flaw in version 4.3.2 (released 2026-09-24); a public proof-of-concept exploit is available.

Elementor, a WordPress page-builder plugin active on more than 10 million sites, shipped a critical logic flaw in the "Editor Events" module introduced with version 4.3.0 (released 2026-09-22). That module is a same-origin REST proxy (`/wp-json/elementor/v1/events/api/...`) that Elementor's browser SDK uses to forward analytics/session-recording events to the Mixpanel platform without the browser needing a valid REST nonce. To allow that, the module registers a callback (`bypass_nonce_check_for_own_routes`) on WordPress's `rest_authentication_errors` filter, backed by a route-matching helper (`is_own_route_request`) meant to confirm a request genuinely targets Elementor's own proxy route before skipping the nonce check. The vulnerable implementation determined this by running a raw, unanchored substring search — `false !== strpos($_SERVER['REQUEST_URI'], 'elementor/v1/events/')` — against the full request URI, which includes the entire query string. Because the query string of any REST request is written entirely by whoever composes the link, an attacker can append an arbitrary, otherwise-meaningless parameter such as `x=elementor/v1/events/` to a request aimed at a completely different REST route and have WordPress's CSRF/nonce protection disabled for that request.

This bypass is not scoped to Elementor's own endpoints: it disables nonce validation across the entire WordPress REST API surface, including WordPress core routes (such as `/wp-json/wp/v2/users`, the user-management endpoint) and the routes exposed by every other installed plugin. Combined with the WordPress REST API's built-in `_method` query-parameter override (which lets a plain GET request be dispatched as a POST) and the `rest_route` query-string routing form, an attacker can construct a single URL — e.g. `/?rest_route=/wp/v2/users&x=elementor/v1/events/` with a `_method=POST` override and a `roles[]=administrator` payload — that, when merely clicked/opened by a browser holding an authenticated administrator session, issues an authenticated POST to the user-creation endpoint with attacker-chosen `username`, `email`, `password`, and `roles[]=administrator` parameters. No JavaScript execution, cross-origin form auto-submission, or attacker-controlled landing page is required — the malicious link can be delivered as-is through email, a chat message, or even a public site comment; Patchstack summarized the impact plainly: "One link, opened by a logged-in WordPress user, makes that user carry out any REST API action their account is permitted to perform." Firing the link in the victim's browser is sufficient to create a fully privileged, attacker-controlled WordPress administrator account, from which the attacker can install malicious plugins, alter themes, change site URLs, modify or deface content, and manipulate other accounts — complete control of the site.

The same "Editor Events" proxy file introduced in 4.3.0 (`core/common/modules/events-manager/rest-api/events-proxy-rest-api.php`) had already drawn a separate, unrelated hardening pass two days earlier: GitHub issue #37421 (filed 2026-09-23 by user `mokabiwd`) reported that the proxy's Mixpanel SDK forwarded its own `Authorization: Basic` header on same-origin requests, which broke sites protected by HTTP Basic Auth (observed in Chrome 153; Firefox unaffected) because the browser treated it as site credentials and dropped the cached realm auth. Elementor fixed that regression in PR #37425 ("Fix: Stop editor events proxy from overriding HTTP Basic Auth [ED-25635]", merged 2026-09-24T10:20:58Z) — a reminder that the whole proxy module was newly-written, under-hardened code shipped in a single minor release.

Security researcher "Saggre" reported the CSRF/nonce-bypass flaw to the WordPress vulnerability-disclosure firm Patchstack on 2026-09-22, the same day 4.3.0 shipped. Elementor released the fix for the CSRF issue in version 4.3.2 on 2026-09-24 via GitHub pull requests #37440 and #37444 ("Fix: Tighten editor events check [ED-25636]", merge commit `5e6d1f3cd9624535c4112235063400716344761d`, merged 2026-09-24T19:02:10Z), which replaced the raw-substring check with logic that reads WordPress's already-parsed `rest_route` query var from the global `$wp` object (`$wp->query_vars['rest_route']`), casts it to a string, and verifies with a strict prefix match (`0 === strpos($route, '/elementor/v1/events/')`) that the request is genuinely targeting Elementor's own namespace. Patchstack, BleepingComputer, and The Hacker News published public advisories on 2026-09-25, and NVD assigned CVE-2026-62062 (CWE-352, CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base score 8.8) the same day. WPScan catalogs the issue as "Elementor 4.3.0 - 4.3.1 - Privilege Escalation via CSRF" (WPScan ID 5e7cb9a3-8284-4ea8-a9f5-de12f78191ab) among the 51 total vulnerabilities it has recorded against the plugin since 2017. A public proof-of-concept exploit pack (`CVE-2026-62062-Abraxas-Labs.py`, published to GitHub under `abraxas/CVE-2026-62062`) demonstrates the full attack chain — a `POST /?rest_route=/wp/v2/users&x=elementor/v1/events/` request with a `roles=administrator` JSON payload and no `X-WP-Nonce` header, returning HTTP 201 — against a local loopback lab (`http://127.0.0.1:8088`) running Elementor 4.3.0/4.3.1 with an active administrator cookie session; its README explicitly restricts use to "the vendor, the site owner, and licensed labs."

As of source publication no confirmed in-the-wild exploitation had been reported, but the combination of a public PoC, no authentication required from the attacker, a trivially deliverable one-click payload, and a roughly 2-million-site unpatched install base at time of disclosure (out of Elementor's 10-million-site total footprint) makes this a high-priority, mass-exploitable web-application vulnerability for defenders running Elementor 4.3.0 or 4.3.1.

MITRE ATT&CK techniques by tactic:

Persistence

T1078 Valid Accounts; T1136 Create Account

Privilege Escalation

T1078 Valid Accounts

Initial Access

T1190 Exploit Public-Facing Application; T1566.002 Spearphishing Link

Execution

T1204.001 Malicious Link

Stealth

T1211 Exploitation for Stealth

Impact

T1491.001 Internal Defacement

Credential Access

T1556 Modify Authentication Process

Resource Development

T1588.005 Exploits

Reconnaissance

T1594 Search Victim-Owned Websites; T1595.002 Vulnerability Scanning

Remediation

Patches

• Elementor 4.3.2 (released 2026-09-24) — GitHub PR #37440 / #37444 'Fix: Tighten editor events check [ED-25636]', merge commit 5e6d1f3cd9624535c4112235063400716344761d

Immediate actions

• Update the Elementor plugin to version 4.3.2 or later immediately on all sites
• Audit the WordPress Users list for unexpected or unauthorized Administrator accounts created since 2026-09-22, particularly ones with unfamiliar usernames or email domains
• Review REST API / access logs for POST (or GET with _method=POST) requests to /wp-json/wp/v2/users or other wp-json/* routes whose query string contains elementor/v1/events/

Workarounds

• Where immediate patching is not possible, deactivate the Elementor plugin (or its Editor Events / analytics experiment) on internet-facing sites
• Block or rate-limit external requests to /wp-json/wp/v2/users and other user-management REST routes at the WAF or reverse-proxy layer

Longer-term hardening

• Adopt a patch-management SLA for high/critical WordPress plugin advisories surfaced by Patchstack, WPScan, or Wordfence
• Deploy WAF or reverse-proxy rules that reject REST API requests combining the _method override parameter with an unrelated Elementor namespace string in the query
• Restrict which accounts can browse to arbitrary links while authenticated as a WordPress administrator (e.g., dedicated hardened browser profile for admin sessions) to reduce one-click CSRF exposure

Affected and fixed versions

• Elementor — Elementor Website Builder (WordPress plugin)
  Vulnerable versions: 4.3.0; 4.3.1
  Fixed in: 4.3.2

Timeline

Last updated 2026-09-27 · revalidated 1× · latest source

• 2026-09-22 Bug hunter 'Saggre' reports the CSRF/nonce-bypass flaw to Patchstack the same day version 4.3.0 ships.
• 2026-09-22 Elementor 4.3.0 is released, introducing the vulnerable Editor Events module (a same-origin Mixpanel analytics proxy) and its flawed rest_authentication_errors nonce-bypass check.
• 2026-09-23 Elementor releases version 4.3.1 while the vulnerable Editor Events nonce-bypass check remains unpatched.
• 2026-09-23 GitHub user 'mokabiwd' files issue #37421 reporting that the same new Editor Events proxy's Mixpanel SDK sends its own Authorization: Basic header, breaking HTTP Basic Auth protected sites in Chrome 153 (regression from 4.2.4).
• 2026-09-24 Elementor releases version 4.3.2, merging PR #37440/#37444 ('Fix: Tighten editor events check [ED-25636]', merge commit locked-ioc-2, merged 2026-09-24T19:02:10Z) which replaces the raw REQUEST_URI substring check with a strict resolved-rest_route prefix check.
• 2026-09-24 Elementor merges PR #37425 ('Fix: Stop editor events proxy from overriding HTTP Basic Auth [ED-25635]', merged 2026-09-24T10:20:58Z), a related fix to the same proxy file closing the Basic Auth regression from issue #37421.
• 2026-09-25 BleepingComputer and The Hacker News publish coverage of the vulnerability, warning of the roughly 2 million sites running the affected versions.
• 2026-09-25 CVE-2026-62062 is published in NVD with CWE-352 classification and a CVSS 3.1 base score of 8.8.
• 2026-09-25 Patchstack publishes the public advisory 'Cross-Site Request Forgery in Elementor Plugin Affecting 2 Million+ Sites', disclosing full technical details of the bypass.
• 2026-09-26 A public proof-of-concept exploit ('CVE-2026-62062-Abraxas-Labs.py', repository abraxas/CVE-2026-62062) is published on GitHub, demonstrating the full one-click admin-account-creation attack against a local loopback lab target.

Update history

• 2026-09-27 — Elementor CSRF Flaw (CVE-2026-62062, CVSS 8.8) Lets Attackers Take Over WordPress Sites via One-Click Admin Link: New indicators (1) Indicator values are withheld at this access level.

Sources cited

• Cross-Site Request Forgery in Elementor Plugin Affecting 2 Million+ Sites patchstack.com · Advisory · 2026-09-25
• NVD - CVE-2026-62062 NVD (NIST) · Advisory · 2026-09-25
• NVD Vulnerability Detail Page - CVE-2026-62062 NVD (NIST) · Advisory · 2026-09-25
• Elementor Website Builder plugin vulnerability entry (WPScan) wpscan.com · Vendor report · 2026-09-25
• Fix: Tighten editor events check [ED-25636] (PR #37440) GitHub · Code repository · 2026-09-24
• Fix: Synced - Tighten editor events check [ED-25636] (PR #37444) GitHub · Code repository · 2026-09-24
• abraxas/CVE-2026-62062 — PoC exploit for CVE-2026-62062 GitHub · Proof of concept · 2026-09-26
• Fix: Stop editor events proxy from overriding HTTP Basic Auth [ED-25635] (PR #37425) GitHub · Code repository · 2026-09-24
• Elementor 4.3.0: Mixpanel events proxy sends its own Authorization header and breaks HTTP Basic Auth protected sites (Issue #37421) GitHub · Code repository · 2026-09-23
• Changelog entry for ED-25636 fix (PR #37445) GitHub · Code repository · 2026-09-24
• Elementor 4.3.0 and 4.3.1: CSRF Enables Administrator Account Creation via a Flawed REST Route Check dev.to · Blog · 2026-09-25
• Elementor WordPress flaw lets attackers create admin accounts BleepingComputer · News · 2026-09-25
• Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link The Hacker News · News · 2026-09-25
• CVE-2026-62062: Critical Elementor CSRF Flaw Enables WordPress Admin Takeover thecybersecguru.com · News · 2026-09-26

More in vulnerability

• Critical Zoom Workplace for Windows Flaws (CVE-2026-108186, CVE-2026-108187) Allow Unauthenticated Remote Privilege Escalation
• Windows SignDrop 0-Day: CLFS (clfs.sys) Local Privilege Escalation to SYSTEM with Public PoC (No CVE Assigned)
• Ivanti EPM SQLi RCE (CVE-2026-121653) and CSA Missing Authentication (CVE-2026-121683); Citrix XenServer and Ivanti Sentry/EPMM Patches
• Git Fixes 6 Vulnerabilities Enabling Code Execution via Cloned Repositories (CVE-2026-111760 et al.)
• CVE-2024-0244 – Unauthenticated Heap Buffer Overflow in Canon MF753Cdw Printer (Fax Job Handling, /wsd/print)

Previous and next in vulnerability

• Microsoft Titan Analytics JWT 'alg:none' Authentication Bypass Exposed Access to 17.3 Trillion ClickHouse Rows Next report