Cross-Site Request Forgery in Elementor Plugin Allows Privilege Escalation on 2 Million+ WordPress Sites

A significant security flaw has been discovered in the Elementor Website Builder plugin, a popular tool used by over two million WordPress sites to create and manage web pages. The vulnerability, identified as a Cross-Site Request Forgery (CSRF) issue, allows unauthenticated attackers to escalate their privileges by tricking a logged-in administrator into clicking a malicious link. This action can lead to the creation of a new administrator account for the attacker, effectively giving them full control over the compromised website.

The vulnerability specifically affects Elementor versions 4.3.0 and 4.3.1. The flaw arises from how the plugin handles WordPress's built-in CSRF protection for REST API requests. In the affected versions, Elementor disables this crucial security measure whenever the string 'elementor/v1/events/' appears in the request URI. Attackers can exploit this by crafting a link that includes this string in the query parameters, even if the actual request is directed elsewhere. This bypasses WordPress's nonce verification, which is designed to prevent unauthorized actions.

Exploitation is deceptively simple. An attacker needs only to convince a logged-in administrator to click a specially crafted link. This link can be delivered via email, chat message, or even a comment on a website. Upon clicking, the administrator's browser automatically performs the malicious REST API action without any further user interaction or JavaScript. On a default WordPress installation, this action can be the creation of a new administrator account, granting the attacker immediate and complete access to the site's backend.

The problematic code resides within the Editor Events module, which is part of Elementor's telemetry system. While this module is controlled by an experiment, it is enabled by default for new installations of Elementor versions 3.32.0 and later. This means that many sites running the vulnerable versions 4.3.0 or 4.3.1 are likely affected, even if administrators haven't manually changed experiment settings.

The vulnerability's technical root lies in the timing and implementation of the rest_authentication_errors filter. Elementor's code attempts to bypass nonce checks for its own routes by checking if the REQUEST_URI contains a specific string. However, this check occurs before WordPress has fully matched the intended REST API route. By manipulating the query string, an attacker can make the REQUEST_URI appear to match Elementor's event route, thereby tricking the plugin into returning true for authentication, effectively disabling all subsequent security checks, including WordPress's own nonce verification.

Patchstack, a security firm specializing in WordPress vulnerabilities, has identified and reported this issue. They have also released mitigation rules to help protect websites from exploitation. Users are strongly advised to update their Elementor Website Builder plugin to a patched version as soon as possible. For those unable to update immediately, security plugins that implement the provided mitigation rules can offer a layer of defense.

This vulnerability highlights the ongoing risks associated with complex plugins that interact deeply with core WordPress functionalities. The widespread adoption of Elementor, with its active installation base exceeding ten million sites, means that this CSRF flaw poses a significant threat to a large portion of the WordPress ecosystem. Administrators should remain vigilant against phishing attempts and ensure all plugins and themes are kept up-to-date to prevent similar attacks.