The Elementor plugin for WordPress contains a CSRF vulnerability that permits an attacker without authentication to create new administrator accounts. This vulnerability arises from insufficient validation of requests that modify user roles, allowing attackers to escalate privileges and gain full administrative control over the WordPress site.

Successful exploitation would allow an unauthenticated attacker to create administrator accounts, granting full control over the affected WordPress site. This could lead to site takeover, data compromise, and further malicious activity under the guise of an administrator.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, site administrators should consider disabling the Elementor plugin or restricting access to trusted users only. Monitoring for suspicious account creations and applying web application firewall (WAF) rules to block CSRF attempts may help mitigate risk.