A critical security vulnerability has been identified in the Elementor Website Builder plugin for WordPress, potentially allowing unauthorized users to gain administrative access to websites. This flaw, which affects over 2 million sites, can be exploited by attackers to create rogue administrator accounts.
Understanding the CSRF Vulnerability
The vulnerability in question is a cross-site request forgery (CSRF) issue with a CVSS score of 8.8 out of 10. It specifically impacts versions 4.3.0 and 4.3.1 of the Elementor plugin, which is widely used across more than 10 million WordPress sites. The flaw allows attackers to perform unauthorized actions on behalf of an authenticated administrator.
According to Patchstack, a cybersecurity company, an attacker simply needs a logged-in user to click a crafted link, which can be disguised as a regular hyperlink in emails, chat messages, or comments. No JavaScript, forms, or controlled web pages are required to execute this attack.
Technical Details of the Exploit
The security loophole arises from inadequate CSRF protection for cookie-authenticated REST API requests in the Editor Events module of the plugin. Specifically, if the request URI contains the string “elementor/v1/events/”, it bypasses security checks. This allows attackers to manipulate REST API requests by appending a seemingly innocuous parameter.
This weakness affects the entire REST API surface, including core WordPress routes and those of other installed plugins. An example exploit involves sending a request to create a new administrator account using the endpoint “/wp/v2/users”.
Resolution and Recommendations
The vulnerability was reported by a researcher known as “Saggre” and has been patched in the newly released version 4.3.2 of Elementor. Users are strongly advised to update their plugins immediately to protect against potential exploitation.
It’s important to note that versions of Elementor prior to 4.3.0 are not affected by this issue, as they do not include the Editor Events proxy feature. Staying updated with the latest plugin versions is crucial for maintaining website security and preventing unauthorized access.
In conclusion, this security flaw underscores the importance of regular updates and vigilance in web security practices. Site administrators should ensure that all plugins are current and regularly check for security advisories.
