Elementor CSRF Flaw: One Click Hands Attackers Admin Rights

A high-severity vulnerability has been disclosed in the Elementor Website Builder plugin for WordPress: it lets an unauthenticated attacker create a rogue administrator account and take full control of a site.

The flaw is a cross-site request forgery (CSRF) issue, still awaiting a CVE identifier and rated 8.8 out of 10 on the CVSS scale. Only versions 4.3.0 and 4.3.1 of the plugin are affected — a plugin active on more than 10 million WordPress sites. According to WordPress.org, the two vulnerable releases alone have been installed on over 2 million sites.

One link is enough

As Patchstack, a WordPress security firm, explains, a single link opened by a logged-in user makes that user carry out any REST API action their account is permitted to perform. On a stock installation, an administrator who clicks the link creates a second administrator account — this time for the attacker.

The attack requires no prerequisites: no JavaScript, no submitted form, no web page under the attacker's control. The link can be a plain anchor tag embedded in an email, a chat message, or a comment.

Where the bug lives

According to the researchers, the problem lies in the Editor Events module, which skips CSRF protection for cookie-authenticated REST API requests whenever the literal string "elementor/v1/events/" appears anywhere in the request URI. Because the URI includes the query string, written by whoever composes the link, any REST request can opt out of that protection by appending a harmless-looking parameter.

The bypass applies to the entire REST API surface of the site — including WordPress core routes and those of every other installed plugin. That makes it possible to create an administrator via the "/wp/v2/users" route simply by tacking on a parameter such as "x=elementor/v1/events/".

Elementor releases before 4.3.0 do not ship the Editor Events proxy and are therefore not affected. The issue was fixed in version 4.3.2, released this week following responsible disclosure. A researcher going by the alias "Saggre" is credited with the discovery. Users are strongly urged to apply the update as soon as possible.

Source: The Hacker News