Loading story…
Elementor Website Builder versions 4.3.0 and 4.3.1 contain a cross-site request forgery (CSRF) flaw that can enable an unauthenticated attacker to create an administrator account on a WordPress site. Exploitation requires convincing a logged-in WordPress administrator to follow a malicious link, causing the victim’s authenticated session to submit a REST API account-creation request.
The issue stems from the Editor Events module bypassing WordPress REST nonce validation when a raw request URI includes elementor/v1/events/; attackers can append that path in query parameters to target other REST endpoints. Elementor fixed the vulnerability in version 4.3.2; organizations running the affected releases—potentially up to 2 million sites—should update immediately and review administrator accounts for unauthorized additions.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Elementor released version 4.3.2 to remediate the Editor Events nonce-validation bypass, preventing the bypass from being triggered through a query string. The vulnerable 4.3.0 and 4.3.1 releases may be deployed on up to 2 million sites.
Patchstack reported a cross-site request forgery vulnerability in Elementor Website Builder 4.3.0 and 4.3.1 to the Elementor team. The flaw could let attackers trick a logged-in WordPress administrator into creating an attacker-controlled administrator account.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively exploiting **CVE-2026-32475**, a critical unauthenticated arbitrary-file-upload vulnerability (CVSS 9.8) in Elementor Website Builder Pro for WordPress. The flaw affects versions through 4.2.1 and lets attackers bypass file-extension and type validation in published Elementor Pro Form widgets with non-required File Upload fields, upload PHP webshells, execute arbitrary commands, and potentially fully compromise affected sites. The vulnerability was fixed in Elementor Pro 4.2.2. Wordfence reported blocking more than 190,000 exploitation attempts shortly after public disclosure; administrators should update immediately and investigate Elementor form-upload directories for unauthorized PHP files, which are a key indicator of compromise.
Sep 6, 2026
A critical privilege escalation vulnerability (CVE-2025-8489) in the King Addons for Elementor WordPress plugin has been actively exploited by attackers. The flaw, present in versions 24.12.92 through 51.1.14, allows unauthenticated users to register as administrators by specifying the `administrator` role during the registration process via a crafted request to the `admin-ajax.php` endpoint. This vulnerability, discovered by Peter Thaleikis and patched in version 51.1.35 on September 25, 2025, affects over 10,000 active installations. Wordfence has reported blocking more than 48,400 exploit attempts since the public disclosure, with mass exploitation beginning in early November 2025. Attackers have used several IP addresses, with two being particularly active, to create rogue admin accounts and potentially seize control of vulnerable sites. Successful exploitation enables attackers to upload malicious code, deliver malware, redirect visitors, or inject spam into compromised sites. Security researchers recommend that website owners upgrade to the patched version immediately and check for unauthorized administrator accounts as a sign of compromise. Wordfence has provided a list of offensive IP addresses for administrators to monitor in their logs. The incident highlights the ongoing risk posed by third-party WordPress plugins and the importance of timely patching and monitoring for suspicious activity.
Jun 29, 2026
A **critical backdoor** was identified in the *LA-Studio Element Kit for Elementor* WordPress plugin (active on **20,000+ sites**), enabling **unauthenticated attackers** to create **administrator** accounts and take full control of affected websites. The issue is tracked as **CVE-2026-0920** with a **CVSS 9.8** rating, and exploitation has been reported **in the wild**. The malicious logic was embedded in the plugin’s registration flow, allowing attackers to elevate privileges during account creation and then perform typical admin-level actions such as uploading malicious files, injecting spam, or redirecting visitors. Technical reporting attributes the backdoor to **sabotage**: the vendor stated the malicious code was planted by a **former employee**, with changes occurring around the time their employment ended. The vulnerable path is the `ajax_register_handle()` function, where attackers can supply a specific registration parameter, `lakit_bkrole`, to obtain administrator capability; the code was described as **obfuscated** to evade detection. CVE documentation characterizes the weakness as improper restriction of user role assignment during registration (mapped to **CWE-269**) and points to the affected versions **up to and including 1.5.6.3**, along with upstream code references and the associated Wordfence advisory.
Jun 29, 2026