Source: thehackernews.com
A high-severity Cross-Site Request Forgery (CSRF) vulnerability has been discovered in the Elementor Website Builder WordPress plugin. The flaw carries a CVSS score of 8.8 out of 10.0 and allows unauthenticated attackers to create rogue administrator accounts and take full control of affected websites. Exploitation requires an admin user to click a specially crafted link. No CVE identifier has been assigned yet at the time of publication. The vulnerability affects specific versions of the plugin, though full version details were not included in the available content. Given the widespread use of Elementor across millions of WordPress sites, the potential impact is significant. Site administrators are advised to monitor for patches and apply updates promptly.
