Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Elementor CSRF bypass mitigation (4.3.2)

Advisory/Mitigation
First reported
Last updated
Happening score
H score 37
1 unique sources, 1 articles

Summary

Hide ▲

Elementor users are being told to upgrade to version 4.3.2 immediately to block a CSRF bypass that can let a logged-in administrator perform attacker-triggered REST API actions. The fix closes the query-string abuse path in the plugin’s Editor Events module. The affected releases are 4.3.0 and 4.3.1, which are used on up to 2 million sites. On default installations, abuse can lead to an attacker-controlled administrator account.

Related Happenings

Elementor plugin WordPress CSRF admin account creation security flaw

Vulnerability
H score1 First: 25.09.2026 21:13 Last: 25.09.2026 21:13 Sources 1

How related: A cross-site request forgery (CSRF) vulnerability in the Elementor plugin for WordPress could allow an unauthenticated attacker to create administrator accounts.

About this happening: A CSRF vulnerability in the Elementor plugin for WordPress lets an unauthenticated attacker force a logged-in administrator to perform REST API actions that can create...

Open Happening

Elementor plugin for WordPress security fix in 4.3.2

Security Patch Release
H score30 First: 25.09.2026 21:13 Last: 25.09.2026 21:13 Sources 1

How related: Elementor released a fix two days later, in version 4.3.2 of the plugin.

About this happening: The Elementor team shipped version 4.3.2 of the Elementor plugin for WordPress to fix a CSRF flaw that could let attackers create administrator accounts on vul...

Open Happening

WordPress core security release (7.1.1)

Security Patch Release
H score45 First: 18.09.2026 19:56 Last: 18.09.2026 19:56 Sources 1

About this happening: WordPress 7.1.1 is a security release that fixed the Click2Shell WordPress Core flaw, a CSRF issue that could let a logged-in administrator open a crafted...

Open Happening

WooCommerce Wholesale Lead Capture plugin 2.0.3.2 security update (CVE-2026-27540)

Security Patch Release
H score9 First: 15.09.2026 17:45 Last: 15.09.2026 17:45 Sources 1

About this happening: The WooCommerce Wholesale Lead Capture plugin's version 2.0.3.2 release closed CVE-2026-27540, an unauthenticated arbitrary file-upload flaw that let attackers upl...

Open Happening

WooCommerce Wholesale Lead Capture actively exploited arbitrary file-upload vulnerability (CVE-2026-27540)

Vulnerability
H score16 First: 15.09.2026 17:45 Last: 15.09.2026 17:45 Sources 1

About this happening: CVE-2026-27540 in the WooCommerce Wholesale Lead Capture WordPress plugin is being actively exploited, putting version 2.0.3.1 and older at risk of PHP webshell...

Open Happening

Timeline

  1. 25.09.2026 21:13 1 articles · 2h ago

    Patchstack reports Elementor CSRF vulnerability to Elementor

    Initial Disclosure

    Patchstack reported a cross-site request forgery vulnerability in the Elementor WordPress plugin to the Elementor team after receiving it from bug hunter Saggre. The flaw affected Elementor versions 4.3.0 and 4.3.1 and could let a logged-in administrator open a malicious link that caused their authenticated session to perform attacker-chosen REST API actions, including creating attacker-controlled administrator accounts on default installations.

    Show sources
    Open in new tab
  2. 25.09.2026 21:13 2 articles · 2h ago

    Elementor releases version 4.3.2 to block the CSRF bypass

    Mitigation Patch Update

    Elementor released version 4.3.2 to fix the query-string bypass in the Editor Events module that checked the raw request URI for the elementor/v1/events/ path and bypassed WordPress REST nonce validation when that string was present. The update prevents attackers from triggering the CSRF flaw through the query string and is the recommended upgrade for affected sites.

    Show sources
    Open in new tab