Elementor Website Builder WordPress Plugin CSRF Vulnerability Disclosed

A high-severity cross-site request forgery (CSRF) vulnerability has been identified in the Elementor Website Builder WordPress plugin. Security researchers report that the flaw carries a CVSS score of 8.8 out of 10.0 and affects current versions of the plugin. The vulnerability is unauthenticated in nature, meaning an attacker does not need valid credentials to exploit it.

The attack vector relies on social engineering: an unauthenticated attacker can craft a malicious link. If an administrator of a WordPress site using the Elementor plugin clicks this link, the attacker can force the administrator's browser to perform actions on their behalf. Specifically, this could result in the creation of a rogue administrator account, granting the attacker full control over the compromised website.

As of the initial disclosure, the vulnerability has not been assigned a CVE identifier. Reports indicate that the patch status is currently unspecified, though a security update from Elementor addressing the CSRF vector is expected. The disclosure was published by The Hacker News on September 26, 2026.