Elementor WordPress Flaw Lets Attackers Create Admin Accounts

2026-09-29

Patchstack, a security firm, has issued a warning to users of the Elementor Website Builder plugin for WordPress regarding a new CSRF vulnerability. This flaw could enable unauthenticated attackers to create administrator accounts through a one-click attack, which requires an authenticated admin to click a malicious link that sends a REST API request to create the account.