Elementor, a WordPress page-builder plugin active on more than 10 million sites, shipped a critical logic flaw in the "Editor Events" module introduced with version 4.3.0 (released 2026-09-22). That module is a same-origin REST proxy (`/wp-json/elementor/v1/events/api/...`) that Elementor's browser SDK uses to forward analytics/session-recording events to the Mixpanel platform without the browser needing a valid REST nonce. To allow that, the module registers a callback (`bypass_nonce_check_for_own_routes`) on WordPress's `rest_authentication_errors` filter, backed by a route-matching helper (`is_own_route_request`) meant to confirm a request genuinely targets Elementor's own proxy route before skipping the nonce check. The vulnerable implementation determined this by running a raw, unanchored substring search — `false !== strpos($_SERVER['REQUEST_URI'], 'elementor/v1/events/')` — against the full request URI, which includes the entire query string. Because the query string of any REST request is written entirely by whoever composes the link, an attacker can append an arbitrary, otherwise-meaningless parameter such as `x=elementor/v1/events/` to a request aimed at a completely different REST route and have WordPress's CSRF/nonce protection disabled for that request.

This bypass is not scoped to Elementor's own endpoints: it disables nonce validation across the entire WordPress REST API surface, including WordPress core routes (such as `/wp-json/wp/v2/users`, the user-management endpoint) and the routes exposed by every other installed plugin. Combined with the WordPress REST API's built-in `_method` query-parameter override (which lets a plain GET request be dispatched as a POST) and the `rest_route` query-string routing form, an attacker can construct a single URL — e.g. `/?rest_route=/wp/v2/users&x=elementor/v1/events/` with a `_method=POST` override and a `roles[]=administrator` payload — that, when merely clicked/opened by a browser holding an authenticated administrator session, issues an authenticated POST to the user-creation endpoint with attacker-chosen `username`, `email`, `password`, and `roles[]=administrator` parameters. No JavaScript execution, cross-origin form auto-submission, or attacker-controlled landing page is required — the malicious link can be delivered as-is through email, a chat message, or even a public site comment; Patchstack summarized the impact plainly: "One link, opened by a logged-in WordPress user, makes that user carry out any REST API action their account is permitted to perform." Firing the link in the victim's browser is sufficient to create a fully privileged, attacker-controlled WordPress administrator account, from which the attacker can install malicious plugins, alter themes, change site URLs, modify or deface content, and manipulate other accounts — complete control of the site.

The same "Editor Events" proxy file introduced in 4.3.0 (`core/common/modules/events-manager/rest-api/events-proxy-rest-api.php`) had already drawn a separate, unrelated hardening pass two days earlier: GitHub issue #37421 (filed 2026-09-23 by user `mokabiwd`) reported that the proxy's Mixpanel SDK forwarded its own `Authorization: Basic` header on same-origin requests, which broke sites protected by HTTP Basic Auth (observed in Chrome 153; Firefox unaffected) because the browser treated it as site credentials and dropped the cached realm auth. Elementor fixed that regression in PR #37425 ("Fix: Stop editor events proxy from overriding HTTP Basic Auth [ED-25635]", merged 2026-09-24T10:20:58Z) — a reminder that the whole proxy module was newly-written, under-hardened code shipped in a single minor release.

Security researcher "Saggre" reported the CSRF/nonce-bypass flaw to the WordPress vulnerability-disclosure firm Patchstack on 2026-09-22, the same day 4.3.0 shipped. Elementor released the fix for the CSRF issue in version 4.3.2 on 2026-09-24 via GitHub pull requests #37440 and #37444 ("Fix: Tighten editor events check [ED-25636]", merge commit `5e6d1f3cd9624535c4112235063400716344761d`, merged 2026-09-24T19:02:10Z), which replaced the raw-substring check with logic that reads WordPress's already-parsed `rest_route` query var from the global `$wp` object (`$wp->query_vars['rest_route']`), casts it to a string, and verifies with a strict prefix match (`0 === strpos($route, '/elementor/v1/events/')`) that the request is genuinely targeting Elementor's own namespace. Patchstack, BleepingComputer, and The Hacker News published public advisories on 2026-09-25, and NVD assigned CVE-2026-62062 (CWE-352, CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base score 8.8) the same day. WPScan catalogs the issue as "Elementor 4.3.0 - 4.3.1 - Privilege Escalation via CSRF" (WPScan ID 5e7cb9a3-8284-4ea8-a9f5-de12f78191ab) among the 51 total vulnerabilities it has recorded against the plugin since 2017. A public proof-of-concept exploit pack (`CVE-2026-62062-Abraxas-Labs.py`, published to GitHub under `abraxas/CVE-2026-62062`) demonstrates the full attack chain — a `POST /?rest_route=/wp/v2/users&x=elementor/v1/events/` request with a `roles=administrator` JSON payload and no `X-WP-Nonce` header, returning HTTP 201 — against a local loopback lab (`http://127.0.0.1:8088`) running Elementor 4.3.0/4.3.1 with an active administrator cookie session; its README explicitly restricts use to "the vendor, the site owner, and licensed labs."

As of source publication no confirmed in-the-wild exploitation had been reported, but the combination of a public PoC, no authentication required from the attacker, a trivially deliverable one-click payload, and a roughly 2-million-site unpatched install base at time of disclosure (out of Elementor's 10-million-site total footprint) makes this a high-priority, mass-exploitable web-application vulnerability for defenders running Elementor 4.3.0 or 4.3.1.