VulnerabilityPublished
Elementor WordPress flaw lets attackers create admin accounts
Source Bleeping Computer
0
Severity
MediumRated Medium by Threat Radar from the Bleeping Computer text
Data as of 28 Sep 2026, 04:42 UTC
What to do
AI-suggested
Until a fix is available, site administrators should consider disabling the Elementor plugin or restricting access to trusted users only. Monitoring for suspicious account creations and applying web application firewall (WAF) rules to block CSRF attempts may help mitigate risk.
Description
A cross-site request forgery (CSRF) vulnerability in the Elementor plugin for WordPress could allow an unauthenticated attacker to create administrator accounts. [...]
References
Community reviews
Loading reviews…