[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-Es-51koD3Jg84dd1dBpIBqVCJ5TdC_t9GD5cpKMcNQ":3},{"article":4,"iocs":44,"watch_terms":45,"solutions":46,"lesson":131},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"14b301d9-fb97-4d86-ad49-0a8ba6f8eb6e","Elementor WordPress flaw lets attackers create admin accounts","elementor-wordpress-flaw-lets-attackers-create-admin-accounts-53c3f8","A cross-site request forgery (CSRF) vulnerability in the Elementor plugin for WordPress could allow an unauthenticated attacker to create administrator accounts. [...]","A cross-site request forgery (CSRF) vulnerability in the Elementor WordPress plugin, versions 4.3.0 and 4.3.1, allows unauthenticated attackers to create administrator accounts. Attackers can trick a logged-in administrator into clicking a malicious link, which leverages the administrator's session to perform a REST API action, thereby creating a new admin account for the attacker. The vulnerability was reported by bug hunter Saggre to Patchstack, who then notified Elementor, leading to a fix in version 4.3.2.","Elementor WordPress plugin vulnerability allows unauthenticated attackers to create admin accounts.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Felementor-wordpress-flaw-lets-attackers-create-admin-accounts\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2023\u002F12\u002F07\u002Fback-2.jpg","2026-09-25T18:13:33+00:00","2026-09-25T20:00:36.826933+00:00",8,[17,20,23],{"name":18,"type":19},"Elementor Website Builder","product",{"name":21,"type":22},"WordPress","technology",{"name":24,"type":25},"Saggre","threat_actor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":26,"icon":28,"name":29,"slug":30},null,"Vulnerabilities","vulnerabilities",[32,34,39],{"category":33},{"id":26,"icon":28,"name":29,"slug":30},{"category":35},{"id":36,"icon":28,"name":37,"slug":38},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18],{"controls":47,"vendors":130},[48,77,105],{"slug":49,"name":50,"problem":51,"products":52},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[53,61,69],{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":57,"product_name":58,"url":59,"description":60},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":78,"name":79,"problem":80,"products":81},"patch-management","Automated patch management","Known holes get closed in days, not months.",[82,90,98],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":78,"product_name":102,"url":103,"description":104},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":106,"name":107,"problem":108,"products":109},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[110,117,123],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":106,"product_name":114,"url":115,"description":116},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":118,"product_name":119,"url":121,"description":122},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":124,"product_name":127,"url":128,"description":129},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[],{"slug":132,"title":133,"body":134,"framework_refs":135,"framework_notes":146},"elementor-csrf-flaw-enables-unauthorized-admin-account-creation","Elementor CSRF Flaw Enables Unauthorized Admin Account Creation","A CSRF vulnerability in Elementor versions 4.3.0 and 4.3.1 allowed unauthenticated attackers to hijack a logged-in administrator's session via a malicious link, exploiting the REST API to silently create rogue administrator accounts. The root problem was insufficient CSRF token validation on a privileged API endpoint, meaning the plugin trusted requests that appeared to originate from an authenticated admin without verifying intent. This is critical because a compromised admin account grants full site control, enabling data theft, malware injection, or complete site takeover. The relatively short window between disclosure and patch (version 4.3.2) underscores how quickly threat actors can weaponize plugin vulnerabilities in the massive WordPress ecosystem, where delayed updates leave millions of sites exposed.",[136,137,138,139,140,141,142,143,144,145],"CIS Control 7: Continuous Vulnerability Management","CIS Control 5: Account Management","CIS Control 6: Access Control Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 SC-8: Transmission Confidentiality and Integrity","OWASP Top 10 A01:2021 – Broken Access Control","OWASP Top 10 A05:2021 – Security Misconfiguration","GDPR Article 32: Security of Processing (integrity and confidentiality obligations)","ITIL Change Management: Emergency Change procedures for critical security patches",{}]