Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: WordPress site administrators using Elementor v4.3.0 or v4.3.1
Incident: CSRF vulnerability allowing unauthorized administrator account creation.
Impact: Full site takeover and complete loss of administrative control.
Attacker: Unidentified threat actors
Analysis: The flaw resides in the Editor Events module, which fails to enforce CSRF protection when a specific string is present in the request URI. By crafting a malicious link, an attacker can trick a logged-in administrator into executing unauthorized REST API calls. This enables the creation of rogue admin accounts without requiring any prior access or complex social engineering.
Recommendations: Update Elementor plugin to version 4.3.2 or newer immediately.; Audit WordPress administrator accounts for any unauthorized or unknown users.; Implement a security plugin to monitor and log unauthorized REST API requests.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source