Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link

A critical Cross-Site Request Forgery (CSRF) vulnerability in the Elementor WordPress plugin allowed unauthenticated attackers to hijack sites by tricking a logged-in administrator into clicking a malicious link. The flaw bypassed authentication controls by exploiting the browser's trusted session context, enabling unauthorized REST API calls that could create rogue administrator accounts. This attack vector is particularly dangerous because it requires no credentials — only a single moment of inattention from a privileged user. The vulnerability highlights how unpatched third-party plugins represent a significant attack surface for WordPress environments, and how social engineering can turn a missing CSRF token into full site compromise.