# Elementor Website Builder CSRF Flaw (CVE-2026-62062) Allows Attacker-Controlled WordPress Admin Account Creation (v4.3.0-4.3.1)

> A cross-site request forgery flaw (CVE-2026-62062, CVSS 8.8) in the Elementor Website Builder WordPress plugin versions 4.3.0-4.3.1 lets an unauthenticated attacker trick a logged-in administrator into clicking a single plain link that creates an attacker-controlled administrator account. The flaw is caused by the Editor Events module's rest_authentication_errors filter bypassing WordPress REST nonce validation whenever the raw request URI contains the substring elementor/v1/events/, letting an attacker-controlled query parameter redirect the bypass to any other REST endpoint, including WordPress core's user-creation route. Elementor patched the flaw in version 4.3.2 (released 2026-09-24); a public proof-of-concept exploit is available.

- **Published:** 2026-09-26T00:00:00Z
- **Last reviewed:** 2026-09-27T03:06:20.723Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2672
- **ID:** TL-2026-2672
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-62062

## Description

Elementor, a WordPress page-builder plugin active on more than 10 million sites, shipped a critical logic flaw in the "Editor Events" module introduced with version 4.3.0 (released 2026-09-22). That module is a same-origin REST proxy (`/wp-json/elementor/v1/events/api/...`) that Elementor's browser SDK uses to forward analytics/session-recording events to the Mixpanel platform without the browser needing a valid REST nonce. To allow that, the module registers a callback (`bypass_nonce_check_for_own_routes`) on WordPress's `rest_authentication_errors` filter, backed by a route-matching helper (`is_own_route_request`) meant to confirm a request genuinely targets Elementor's own proxy route before skipping the nonce check. The vulnerable implementation determined this by running a raw, unanchored substring search — `false !== strpos($_SERVER['REQUEST_URI'], 'elementor/v1/events/')` — against the full request URI, which includes the entire query string. Because the query string of any REST request is written entirely by whoever composes the link, an attacker can append an arbitrary, otherwise-meaningless parameter such as `x=elementor/v1/events/` to a request aimed at a completely different REST route and have WordPress's CSRF/nonce protection disabled for that request.

This bypass is not scoped to Elementor's own endpoints: it disables nonce validation across the entire WordPress REST API surface, including WordPress core routes (such as `/wp-json/wp/v2/users`, the user-management endpoint) and the routes exposed by every other installed plugin. Combined with the WordPress REST API's built-in `_method` query-parameter override (which lets a plain GET request be dispatched as a POST) and the `rest_route` query-string routing form, an attacker can construct a single URL — e.g. `/?rest_route=/wp/v2/users&x=elementor/v1/events/` with a `_method=POST` override and a `roles[]=administrator` payload — that, when merely clicked/opened by a browser holding an authenticated administrator session, issues an authenticated POST to the user-creation endpoint with attacker-chosen `username`, `email`, `password`, and `roles[]=administrator` parameters. No JavaScript execution, cross-origin form auto-submission, or attacker-controlled landing page is required — the malicious link can be delivered as-is through email, a chat message, or even a public site comment; Patchstack summarized the impact plainly: "One link, opened by a logged-in WordPress user, makes that user carry out any REST API action their account is permitted to perform." Firing the link in the victim's browser is sufficient to create a fully privileged, attacker-controlled WordPress administrator account, from which the attacker can install malicious plugins, alter themes, change site URLs, modify or deface content, and manipulate other accounts — complete control of the site.

The same "Editor Events" proxy file introduced in 4.3.0 (`core/common/modules/events-manager/rest-api/events-proxy-rest-api.php`) had already drawn a separate, unrelated hardening pass two days earlier: GitHub issue #37421 (filed 2026-09-23 by user `mokabiwd`) reported that the proxy's Mixpanel SDK forwarded its own `Authorization: Basic` header on same-origin requests, which broke sites protected by HTTP Basic Auth (observed in Chrome 153; Firefox unaffected) because the browser treated it as site credentials and dropped the cached realm auth. Elementor fixed that regression in PR #37425 ("Fix: Stop editor events proxy from overriding HTTP Basic Auth [ED-25635]", merged 2026-09-24T10:20:58Z) — a reminder that the whole proxy module was newly-written, under-hardened code shipped in a single minor release.

Security researcher "Saggre" reported the CSRF/nonce-bypass flaw to the WordPress vulnerability-disclosure firm Patchstack on 2026-09-22, the same day 4.3.0 shipped. Elementor released the fix for the CSRF issue in version 4.3.2 on 2026-09-24 via GitHub pull requests #37440 and #37444 ("Fix: Tighten editor events check [ED-25636]", merge commit `5e6d1f3cd9624535c4112235063400716344761d`, merged 2026-09-24T19:02:10Z), which replaced the raw-substring check with logic that reads WordPress's already-parsed `rest_route` query var from the global `$wp` object (`$wp->query_vars['rest_route']`), casts it to a string, and verifies with a strict prefix match (`0 === strpos($route, '/elementor/v1/events/')`) that the request is genuinely targeting Elementor's own namespace. Patchstack, BleepingComputer, and The Hacker News published public advisories on 2026-09-25, and NVD assigned CVE-2026-62062 (CWE-352, CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base score 8.8) the same day. WPScan catalogs the issue as "Elementor 4.3.0 - 4.3.1 - Privilege Escalation via CSRF" (WPScan ID 5e7cb9a3-8284-4ea8-a9f5-de12f78191ab) among the 51 total vulnerabilities it has recorded against the plugin since 2017. A public proof-of-concept exploit pack (`CVE-2026-62062-Abraxas-Labs.py`, published to GitHub under `abraxas/CVE-2026-62062`) demonstrates the full attack chain — a `POST /?rest_route=/wp/v2/users&x=elementor/v1/events/` request with a `roles=administrator` JSON payload and no `X-WP-Nonce` header, returning HTTP 201 — against a local loopback lab (`http://127.0.0.1:8088`) running Elementor 4.3.0/4.3.1 with an active administrator cookie session; its README explicitly restricts use to "the vendor, the site owner, and licensed labs."

As of source publication no confirmed in-the-wild exploitation had been reported, but the combination of a public PoC, no authentication required from the attacker, a trivially deliverable one-click payload, and a roughly 2-million-site unpatched install base at time of disclosure (out of Elementor's 10-million-site total footprint) makes this a high-priority, mass-exploitable web-application vulnerability for defenders running Elementor 4.3.0 or 4.3.1.

## MITRE ATT&CK

- T1594 Search Victim-Owned Websites
- T1595.002 Vulnerability Scanning
- T1588.005 Exploits
- T1190 Exploit Public-Facing Application
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1136 Create Account
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1556 Modify Authentication Process
- T1211 Exploitation for Stealth
- T1491.001 Internal Defacement

## Sources

- [Elementor WordPress flaw lets attackers create admin accounts](https://www.bleepingcomputer.com/news/security/elementor-wordpress-flaw-lets-attackers-create-admin-accounts/)
- [Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link](https://thehackernews.com/2026/09/elementor-csrf-flaw-lets-attackers-take.html)
- [Cross-Site Request Forgery in Elementor Plugin Affecting 2 Million+ Sites](https://patchstack.com/articles/cross-site-request-forgery-in-elementor-plugin-affecting-2-million-sites/)
- [Elementor 4.3.0 and 4.3.1: CSRF Enables Administrator Account Creation via a Flawed REST Route Check](https://dev.to/anoymask/elementor-430-and-431-csrf-enables-administrator-account-creation-via-a-flawed-rest-route-check-4m57)
- [Fix: Tighten editor events check ED-25636 (PR #37440)](https://github.com/elementor/elementor/pull/37440)
- [Fix: Synced - Tighten editor events check ED-25636 (PR #37444)](https://github.com/elementor/elementor/pull/37444)
- [abraxas/CVE-2026-62062 — PoC exploit for CVE-2026-62062](https://github.com/abraxas/CVE-2026-62062)
- [Elementor Website Builder plugin vulnerability entry (WPScan)](https://wpscan.com/plugin/elementor/)
- [NVD - CVE-2026-62062](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-62062)
- [CVE-2026-62062: Critical Elementor CSRF Flaw Enables WordPress Admin Takeover](https://thecybersecguru.com/news/elementor-cve-2026-62062-csrf-vulnerability/)
- [Fix: Stop editor events proxy from overriding HTTP Basic Auth ED-25635 (PR #37425)](https://github.com/elementor/elementor/pull/37425)
- [Elementor 4.3.0: Mixpanel events proxy sends its own Authorization header and breaks HTTP Basic Auth protected sites (Issue #37421)](https://github.com/elementor/elementor/issues/37421)
- [Changelog entry for ED-25636 fix (PR #37445)](https://github.com/elementor/elementor/pull/37445)
- [NVD Vulnerability Detail Page - CVE-2026-62062](https://nvd.nist.gov/vuln/detail/CVE-2026-62062)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2672