Elementor Flaw Lets Attackers Hijack WordPress Sites With a Single Admin Click
A cross-site request forgery bug in the popular page-builder plugin can create rogue admin accounts if a logged-in administrator visits a booby-trapped page.
Key points
- A high-severity flaw in Elementor, a page-builder plugin installed on millions of WordPress sites, lets attackers create hidden administrator accounts if a logged-in admin clicks a malicious link.
- The bug is a cross-site request forgery issue with a CVSS severity score of 8.8 out of 10, and does not yet have a CVE identifier.
- No login is needed on the attacker's side: the victim's own browser does the damage while they're signed in.
- Site owners should update Elementor to the latest release from the official plugin page and audit admin accounts for unfamiliar users.
- This is the second Elementor vulnerability we've reported since August, when a flaw in the paid version let strangers upload and run PHP files.
A newly disclosed flaw in Elementor, one of the most widely used WordPress plugins for designing web pages, lets an attacker take over a site if an administrator can be tricked into clicking the wrong link.
The bug is a cross-site request forgery, or CSRF. While an admin is logged into their own WordPress site, a separate page loading in the same browser can quietly send commands to the site as if the admin had typed them. Here, those commands create a brand new administrator account under the attacker's control.
The flaw was first detailed by The Hacker News. It carries a CVSS score of 8.8 out of 10 and hasn't been assigned a CVE tracking number yet.
How does the attack actually work?
An attacker sends a WordPress administrator a link, by email or chat. The admin, already logged in, clicks it. The malicious page then fires a request using the admin's active session to quietly add a new user with full control.
No password is needed. No encryption needs breaking. The attack relies entirely on the site trusting the admin's browser and the plugin failing to verify that a sensitive request genuinely came from inside the site's own dashboard.
That missing check is the whole bug. WordPress provides a built-in defence called a nonce, a short one-time token that proves a request originated from a legitimate page. The vulnerable Elementor code path didn't verify one properly.
Who is affected?
Any site running a vulnerable version of Elementor is at risk if an administrator can be lured into clicking an attacker's link. Elementor is active on millions of WordPress installs, making the pool of possible targets very large. The fix is to update the plugin from the Elementor listing on WordPress.org.
| Detail | Value |
|---|---|
| Plugin | Elementor Website Builder |
| Bug class | Cross-site request forgery (CSRF) |
| CVSS score | 8.8 (high) |
| CVE ID | Not yet assigned |
| Attacker prerequisite | Admin clicks a crafted link while logged in |
| Fix | Update to the latest Elementor release |
What should site owners do now?
Update Elementor today, then check the WordPress Users screen for administrator accounts you don't recognise. Delete any you can't account for and force a password reset on those that remain. If your site allows it, turn on multi-factor authentication for every admin. It wouldn't have blocked this specific bug, but it sharply limits what a stolen session can do next.
For anyone running WordPress as a side business or shop front, the practical lesson is duller than the headline. Don't stay logged into the admin dashboard while browsing unrelated links. Use a separate browser profile, or log out when you're done editing.
CSRF in 2025 is an unforced error, and it keeps recurring in plugins precisely because the WordPress ecosystem rewards shipping features fast. Proof-of-concept code tends to appear within days of any technical writeup, because the attack pattern is trivial to weaponise once the vulnerable endpoint is known. Given that we've now seen hidden admin accounts planted via a poisoned plugin update and this CSRF route in the same month, the diversity of paths to WordPress admin access is the thing worth watching.
Common questions
Do I need to do anything if I only visit WordPress sites, not run one?
No. This flaw targets site administrators, not readers or shoppers. The risk to visitors is indirect: a hijacked site could later serve scams or malware, which is why owners updating quickly matters.
Would two-factor authentication have stopped this?
Not directly. The attack rides on an already-authenticated session, so a second factor at login isn't challenged. It still helps by making the initial login harder to steal and by flagging unusual new sessions.
