Threat Intelligence

Elementor Plugin Bug Lets Attackers Hijack WordPress Sites With a Single Click

The Hacker News · 26 Sept 2026

Key Takeaway If your business uses Elementor, update the plugin to version 4.3.2 or later immediately and remind staff to avoid clicking unexpected links while logged into WordPress admin accounts.

A high-severity cross-site request forgery (CSRF) vulnerability has been found in the Elementor Website Builder plugin for WordPress, which is used on more than 10 million sites. The flaw, rated 8.8 out of 10 in severity, affects versions 4.3.0 and 4.3.1, which alone are installed on over 2 million sites.

According to security firm Patchstack, the bug allows an attacker to trick a logged-in user, particularly an administrator, into clicking a single link that silently performs actions on their behalf, including creating a new administrator account for the attacker. No malicious website, form submission, or special scripting is required; the link could be hidden in an email, chat message, or comment. The issue arises because a specific part of Elementor's code skips normal CSRF protections whenever a certain text string appears in the web request, effectively opening up the entire site's backend functions to abuse.

Elementor has fixed the issue in version 4.3.2, released this week, following responsible disclosure by a researcher known as "Saggre". Versions prior to 4.3.0 are not affected, as they do not contain the vulnerable code component.

WordPress Elementor CSRF Plugin Vulnerability Website Security

Summarised by CISO AI from The Hacker News. We link back to every original so you can read it yourself.