Elementor Plugin Flaw Could Let Hackers Grant Themselves WordPress Admin Rights

A critical cross‑site request forgery (CSRF) flaw has been identified in Elementor, a widely used page‑builder plugin for WordPress, that could enable an unauthenticated attacker to create new administrator accounts on vulnerable sites.

Elementor powers millions of WordPress sites by providing drag‑and‑drop design tools that simplify theme creation and content layout. Its popularity means the plugin is often a high‑value target for malicious actors seeking privileged access to sites that rely on it for front‑end functionality.

The vulnerability stems from insufficient verification of requests that trigger the creation of new users. Because the request can be forged from a remote location, an attacker does not need to be logged in or possess any existing credentials. By crafting a malicious link or embedding code on a compromised page, the attacker can cause the affected WordPress installation to generate an admin‑level user account under their control.

Elementor’s development team has responded by releasing a security update that addresses the CSRF weakness. The patch adds proper nonce checks and validates the origin of user‑creation requests, effectively blocking the exploit. Security advisories from WordPress.org and major hosting providers now recommend that site owners apply the update immediately and review any newly created accounts for signs of intrusion.

The discovery underscores a broader challenge in the WordPress ecosystem: third‑party plugins can introduce serious security gaps even when the core platform remains robust. Administrators are reminded to keep all extensions up to date, employ least‑privilege principles for user roles, and monitor logs for unexpected account creation events.

The issue was first reported by security outlet BleepingComputer, which highlighted the ease with which the flaw could be leveraged. Researchers continue to monitor for active exploitation, and users are advised to stay alert for any suspicious activity while ensuring their installations run the latest, patched versions of Elementor and WordPress.