Elementor CSRF

A high-severity flaw in the Elementor Website Builder plugin could let an unauthenticated attacker create rogue administrator accounts and take full control of a WordPress site, and the worst part is how little it takes to pull off.

The vulnerability is a cross-site request forgery issue that has not yet been assigned a CVE identifier, but it carries a CVSS score of 8.8 out of 10.0, and it only affects versions 4.3.0 and 4.3.1 of the plugin, which is active on over 10 million WordPress sites.

Statistics from WordPress.org show that the two impacted versions alone have been installed on more than 2 million sites, so while the window is narrow, the population inside it is large.

Quick Summary

What the Attack Actually Requires

Patchstack explained it plainly, saying one link, opened by a logged-in WordPress user, makes that user carry out any REST API action their account is permitted to perform, and on a stock installation, an administrator clicking the link creates a second administrator account for the attacker.

The WordPress security company also said the attack does not hinge on any prerequisite like JavaScript, a submitted form, or a web page under the threat actor's control, which means the usual defenses people rely on do not apply here.

The link can even be a plain anchor tag embedded in an email, a chat message, or a comment, so the attacker does not need a fancy lure or a compromised website, just a convincing reason for an admin to click.

The Root Cause

Patchstack said the vulnerability stems from the Editor Events module skipping CSRF protection for cookie-authenticated REST API requests every time the literal string elementor/v1/events/ appears anywhere in the request URI.

Because the request URI includes the query string, and the query string is written by whoever composes the link, any REST request can opt itself out of that protection by appending a harmless-looking parameter, which is a remarkably simple bypass for such a serious outcome.

The bypass applies to the entire REST API surface of a site, including WordPress core routes and the routes of every other plugin installed on it, so the flaw is not limited to Elementor's own functionality.

An attacker could exploit this loophole to create an administrator account through /wp/v2/users using a crafted request, and once that account exists, the attacker has full control of the site.

Why Older Versions Are Safe

Elementor releases before 4.3.0 do not ship the Editor Events proxy, so they are not affected by the flaw, which is a small mercy for anyone who has not updated in a while.

Following responsible disclosure, the issue has been addressed in version 4.3.2 released earlier this week, and a security researcher going by the alias Saggre has been credited with discovering and reporting the bug.

So the fix is available, and the affected window is narrow, but the number of sites running 4.3.0 and 4.3.1 makes this worth treating seriously.

What You Should Do

• Update Elementor to 4.3.2 immediately, because that is the only complete fix for this flaw.
• Check whether your site is running 4.3.0 or 4.3.1, since older versions are safe and newer versions include the patch.
• Audit your administrator accounts for anything you did not create, especially accounts with unusual usernames or email addresses.
• Review your REST API logs for requests containing elementor/v1/events/, because that string is the signature of the bypass.
• Warn your administrators about clicking unfamiliar links, even if they come from a trusted-looking source, because this attack requires nothing more than a click.
• Consider a web application firewall as a temporary layer, though it is not a substitute for patching.

The Bottom Line

An Elementor CSRF flaw affects versions 4.3.0 and 4.3.1, and a single link clicked by a logged-in administrator can create a rogue admin account, so if you run Elementor on a WordPress site, update to 4.3.2 now, then check your admin accounts and REST API logs for signs that someone got there first.

Quick Reference

What to Do

• Update to 4.3.2
• Check your current version
• Audit admin accounts
• Review REST API logs
• Warn administrators about links
• Consider a WAF as backup

FAQ Section

What is the Elementor CSRF vulnerability?

It is a cross-site request forgery flaw in Elementor versions 4.3.0 and 4.3.1 that lets an attacker make a logged-in user perform REST API actions, including creating an administrator account.

How does the attack work?

The Editor Events module skips CSRF protection when the string elementor/v1/events/ appears in the request URI, and since the query string is attacker-controlled, any REST request can bypass the check.

Which versions are affected?

Only versions 4.3.0 and 4.3.1 are affected, and versions before 4.3.0 are safe because they do not include the Editor Events proxy.

How was it fixed?

It was fixed in version 4.3.2, released earlier this week, after responsible disclosure, and researcher Saggre is credited with the discovery.

Does the attacker need JavaScript or a form?

No, Patchstack said the attack does not require JavaScript, a submitted form, or a page under the attacker's control, and a plain link in an email or chat message is enough.

What should I do if I use Elementor?

Update to 4.3.2 immediately, audit your admin accounts, and review your REST API logs for the bypass string.

Source: The Hacker News