Description

Cross-Site Request Forgery (CSRF) vulnerability in Elementor Website Builder allows Cross Site Request Forgery. This issue affects Elementor Website Builder: from n/a through 4.3.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-25T07:16:54.010Z",
  "pubdate": "2026-09-25T07:16:54.010Z",
  "executiveSummary": "Elementor Website Builder is affected by a Cross-Site Request Forgery (CSRF) vulnerability, identified in versions ranging from n/a through 4.3.1.\nThe vulnerability allows an unauthenticated or remote attacker to force an authenticated administrator to execute unintended actions within the WordPress environment.\nBy tricking a privileged user into interacting with a malicious URL or web page, an attacker can perform unauthorized state-changing operations, such as modifying site configurations, injecting malicious content, or creating new administrative accounts.\nThe risk is considered significant as it exploits the trust that the application has in the authenticated user's browser session, bypassing intended access controls without requiring direct access to the administrative credentials.\nSuccessful exploitation depends on the victim's active session and interaction with crafted malicious content.",
  "technicalDetails": "The vulnerability exists due to the lack of sufficient anti-CSRF token validation within the affected versions of Elementor Website Builder. CSRF occurs when a web application fails to verify that a state-changing request was intentionally initiated by the authenticated user rather than forged by a malicious third party.\nIn the context of Elementor, the application processes administrative requests—such as saving templates, modifying settings, or updating site metadata—without ensuring the presence and validity of a unique, cryptographically strong synchronizer token for each request.\nThe attack flow begins with the attacker crafting a malicious payload, typically embedded within an HTML document or a hidden script on an external site. This payload is designed to trigger a POST or GET request directed at the target WordPress site's administrative endpoints associated with the vulnerable Elementor component.\nWhen an authenticated administrator visits the attacker-controlled page, the browser automatically includes the administrator's session cookies with the forged request. Because the application logic does not perform a secondary validation (such as checking a nonce or hidden form token), the server processes the forged request as a legitimate instruction from the administrator.\nThe impact of this vulnerability is severe, as it grants the attacker the ability to manipulate the site's operational state. Depending on the specific vulnerable endpoints exposed, an attacker could inject malicious JavaScript into pages (leading to Stored XSS), modify global site settings, or execute administrative functions that could lead to full site compromise.\nThe exploitation does not require the attacker to bypass authentication protocols directly; instead, it leverages the legitimate session established between the administrator and the server. The vulnerability is present in versions n/a through 4.3.1, affecting all sites running these versions of the Elementor Website Builder without adequate compensating controls."
}