Elementor Plugin Flaw Lets Unauthenticated Attackers Create Admin Accounts

Key points

• Unauthenticated attackers can exploit a CSRF flaw in the Elementor plugin.
• Successful exploitation creates admin accounts, giving full control of WordPress sites.
• No CVE has been assigned; severity is rated high.
• Site owners should update immediately and monitor for suspicious admin users.

A vulnerability has been found in the Elementor extension for WordPress. It allows attackers who are not logged in to perform cross-site request forgery (CSRF) attacks. By exploiting this, they can create new administrator accounts on vulnerable sites.

Any WordPress site running the Elementor plugin is potentially at risk. This includes K-12 school websites, district portals, and other educational platforms built on WordPress. The vulnerability does not require authentication, making it easy to exploit at scale.

Once an attacker creates an admin account, they gain complete control over the site. They can install malicious plugins, alter content, steal data, or use the site to distribute malware. This can lead to data breaches, reputational damage, and disruption of services.

CSRF vulnerabilities typically require a logged-in user to be tricked, but here the attack is unauthenticated, which is unusual and dangerous. No CVE identifier has been assigned yet, but the severity is high. The lack of a CVE may delay detection and patching.

Monitor for plugin updates from Elementor. Check for unexpected admin accounts. Review logs for suspicious POST requests. Consider implementing a web application firewall (WAF) with CSRF protections.

What to do now

1. Immediately update the Elementor plugin to the latest version if a patch is available; if not, consider disabling it until a fix is released.
2. Audit WordPress user accounts for any unauthorized administrator accounts and remove them.
3. Enable two-factor authentication for all admin users and enforce strong passwords.
4. Deploy a web application firewall (WAF) with rules to block CSRF attempts targeting the Elementor plugin.
5. Monitor server logs for suspicious POST requests to admin-ajax.php or other plugin endpoints.
6. Restrict access to wp-admin and login pages by IP address where feasible.
7. Subscribe to security advisories for WordPress and Elementor to receive timely updates.

Original source

BleepingComputer