Skip to main content
VulnerabilityPublished

Elementor WordPress flaw lets attackers create admin accounts

Source Bleeping Computer

0
Severity
Medium

Rated Medium by Threat Radar from the Bleeping Computer text

Data as of 28 Sep 2026, 04:42 UTC

What to do

AI-suggested

Until a fix is available, site administrators should consider disabling the Elementor plugin or restricting access to trusted users only. Monitoring for suspicious account creations and applying web application firewall (WAF) rules to block CSRF attempts may help mitigate risk.

Description

A cross-site request forgery (CSRF) vulnerability in the Elementor plugin for WordPress could allow an unauthenticated attacker to create administrator accounts. [...]

References

Community reviews

Loading reviews…