Elementor WordPress flaw lets attackers create admin accounts

A CSRF vulnerability in Elementor versions 4.3.0 and 4.3.1 allowed unauthenticated attackers to hijack a logged-in administrator's session via a malicious link, exploiting the REST API to silently create rogue administrator accounts. The root problem was insufficient CSRF token validation on a privileged API endpoint, meaning the plugin trusted requests that appeared to originate from an authenticated admin without verifying intent. This is critical because a compromised admin account grants full site control, enabling data theft, malware injection, or complete site takeover. The relatively short window between disclosure and patch (version 4.3.2) underscores how quickly threat actors can weaponize plugin vulnerabilities in the massive WordPress ecosystem, where delayed updates leave millions of sites exposed.