If your site runs the free Elementor plugin, check its version. In 4.3.0 and 4.3.1, a logged-in administrator could open a single link and unknowingly create a new administrator account with login details chosen by someone else. The fix is in 4.3.2. That’s the short version. Check before you get back to your inbox.
Patchstack rated the flaw high severity, with a CVSS score of 8.8. Its September 25, 2026 advisory doesn’t report attacks in the wild, and there were no public reports of active exploitation as of September 28. That’s reassuring, but it’s not a reason to leave an affected version running.
What went wrong inside Elementor?
WordPress normally checks for a hidden token, called a nonce, before accepting certain requests from your logged-in browser. Picture a stamp from your dashboard: yes, this request started here. No stamp? A link from somewhere else shouldn’t get to make your site act on your behalf. Tricking your browser into doing that is called cross-site request forgery, or CSRF.
Elementor 4.3.0 added a feature that sends editor usage data through the WordPress REST API – the built-in way the editor, apps and plugins talk to your site. Elementor wanted requests to its own events address to skip that token check. Fair enough. The mistake was checking for elementor/v1/events/ anywhere in the web address, including after the question mark. Anyone making a link can put text there.
So a request aimed at another part of WordPress could carry that text and slip past the check. Elementor would say it was already authenticated, which skipped other security plugins using that same check too. And WordPress lets a plain link behave like a form submission. No special website. No script. Just a link in an email, chat or comment. Version 4.3.2 checks the real route instead; extra text after the question mark no longer counts.
Why one click matters to a shop owner
You’re halfway through packing orders. An email says there’s a problem with order #1047, so you click. Sound familiar? The link can point at your own domain, with /wp-json/ in the address. It doesn’t need to look like some obviously dodgy website.
This trick works while you’re logged in. I’ve seen owners stay logged in for weeks because the same browser handles email and WordPress, and the “Remember me” box is right there. Strong passwords and two-factor authentication are still great. But 2FA doesn’t stop this particular click: nobody’s guessing your password or logging in as you. They’re riding the session you already opened.
The researcher’s example showed an admin click creating a fresh administrator account with a username and password picked by the attacker. It also showed access to site settings. You’d see a page of raw text. Easy to shrug off as a broken link, especially with orders piling up.
What could someone do with their own admin login afterward? Install a plugin as a backdoor, change payment settings, add checkout skimming code, download customer data or lock you out. Those are things an admin account can do, not reported outcomes of this flaw. An editor or shop manager could be tricked too, but only within that account’s permissions.
Is your site affected?
The affected versions are 4.3.0 and 4.3.1 only. Elementor released 4.3.0 on September 22, 2026, 4.3.1 on September 23, and the fixed 4.3.2 on September 24. Roughly two days as the current release. But auto-updates could have installed 4.3.0 for you, and a site that stopped updating afterward could still be on either affected version.
The feature behind the flaw is a hidden Elementor experiment. You won’t find it on the Experiments screen, so don’t go hunting for an off switch. It’s on by default for sites whose first Elementor install was 3.32.0 or later; a fresh install of affected 4.3.x with no settings changed is affected. Honestly, working out your install history is more bother than it’s worth. Check the version and update.
Versions 4.2.x and earlier don’t have this bug because the feature arrived in 4.3.0. Update those too – older releases have their own fixed issues. Paying for Pro? Check the free “Elementor” plugin as well, since Pro needs it to run. We covered a different Elementor Pro issue fixed in Pro 4.2.2; this bug is in the free plugin. And don’t expect the 4.3.2 changelog to warn you clearly. Its closest line is the vague “Improved code security enforcement in data handling.”
What to click right now
- Open Plugins > Installed Plugins and find “Elementor,” the free plugin. If its version is 4.3.0 or 4.3.1, update to 4.3.2 or newer now. Take a quick backup first if you can, but don’t postpone the fix for days over it.
- Reload the Plugins screen and check that the version number actually changed. An update button isn’t proof the update finished. If changes to your shop layout worry you, follow this guide to safely updating plugins for the checks afterward.
- Consider the “Enable auto-updates” link on that screen. Auto-updates got some sites onto 4.3.0 on September 22, but could also deliver the fix two days later. For most small sites I’d leave them on, with a backup and someone checking the site after updates.
- Go to Users > All Users and click the “Administrator” filter. Count the accounts. Do you recognise every name and email, including anyone added since September 22? An activity log can show when accounts appeared. Without one, your host’s phpMyAdmin shows a registration date,
user_registered, in thewp_userstable. - Open Settings > General and make sure the Administration Email Address is still yours.
Found an admin you don’t recognise?
Don’t panic-delete it first. Screenshot the account and note its username, email and user ID. Check your activity log or ask your host for logs to see when it appeared and what it did. Then delete it. WordPress will ask what to do with its content; attribute it to yourself and review it afterward.
Change every admin’s password, then use “Log Out Everywhere Else” on each admin’s profile. Look through Plugins and Themes for anything new or unfamiliar, and run a malware scan. If that account installed something, changed files or touched checkout or payment settings, this isn’t a tidy-up. Treat it as a hacked site and get proper site cleanup help.
A better habit for the next odd link
Use a separate browser profile for admin work and log out when you’re done. Keep a lower-rights account for everyday tasks if you can, saving the admin login for actual admin jobs. An activity log helps too. Dates beat guessing.
Page builders change fast, and someone needs to watch the updates. Especially when the security fix is tucked behind a changelog line that tells you almost nothing. For now, start with the number beside the free Elementor plugin.